Has anyone made any progress on the 0411 flashing? Been following this for a long time, checking about every day. Very interesting.

 

Finally had some free time this weekend! I updated the app for the 411 security algo as well as changed the configuration for the 411 PCM. I also rewrote the kernal, and it executes, but still having some trouble properly reading in received data from the DLC chip since its so different. The kernal returns an Rx FIFO buffer overflow error when I try to contact the PCM.

Once I get that fixed then its a matter of validating the flash chip unlocks. If that works then it should be good to go.

 

awesome news!
I check this thread daily.

 

Yes this is awesome news. I also check this thread daily.

Maybe we will get a fantastic Christmas present this year

 

Got it to boot and do basic comms now, but have to iron out sending large frames. Something in the code the DLC still doesn't like.

 

It works! Did my first reflash with it and had no issues doing the cal sector. Found the problem with the kernal, namely my fat fingers typing the wrong thing in for one of the commands. PCM read the wrong thing in after receiving a frame and thought it was seeing a network fault.

Just have to add some error checking to the main application and the beta version should be good to start testing.

 

Awesome!
This is the dawning of a new era!

 

Sounds good, now I will just need a XDF file for the 1221256 operating system I am running in my 0411 PCM in my 97 Express.

Would be nice to be able to turn highway mode on and access some hidden areas of the tune. HP Tuners keeps saying it can't be done except on an Holden setup and I know they are full of BS.

It would also be able to simply change the VIN to my 97 VIN in case I need it for emissions reasons some time in the future. Since it is a PCM retrofit to an older vehicle with their stupid licensing setup it would not be tuneable with their software after a VIN swap.

 

I played with it some more, and Im able to do a full reflash of both the OS and calibration without issue. One thing I did notice is that the PCM updated the flash chip at about address 0x4900 after the reflash when I pulled the updated bin off. Everything else was the same.

Q: do these PCMs have a "box not locked" error code? It looks like it might be flagging the reflash. If it is hopefully simply erasing the area during a reflash will undo it.

The only other thing I could think of is that somehow the crash data recorder was inadvertently tripped and it did a dump to the flash chip.

 

has anyone made any progress with a cheaper home built cable instead of the AVT interface?

 

Some people have been working on cables in the 80-120 dollar range. There are some options out there commercially as well, but they are not much cheaper than the AVT. The AVT is popular in that it has an easy to use interface that is almost as easy to use as the old 2-transistor cables. The USB and FTDI chipset just looks like a com port to the PC. It also works easily with tunerpro and supports all the OBD-II standards, which is a big plus for scanning.

One thing that hampers cable development is the large OBD-II standard that must be adhered to. There are requirements on timing as well as node arbitration and autonomous communication. The cable itself must essentially be a stand-alone controller that can send/receive frames on its own without external intervention. To this end the AVT uses an ARM with built-in firmware.

 

Checked into this, and the data recorder spans from 0x5000-0x6000, so thats not it, and the PCM only checks from 0x8000 and up during checksums, so anything below that is validated by the main OS. In my code there are 3 seperate interlocks that would have to be overcome to write before 0x8000, and even manually trying to bypass them always results in the PCM rejecting the request as an invalid write address, so its a mystery as to how that area got altered

Maybe bad flash or a hardware glitch.

 

What is the best place currently to pick up an AVT cable at the best price?

 

Ok, so it seems that I'll be able to use the 0411 for some of my upcoming projects now. I need to get up to speed on tuning this pcm, as well as what options are available as far as modified programs go.
Any good repositories of such info?

 

Well I'll be damned! Turns out these PCMs actually keep a log of when they have been reflashed in the unused sector below the calibration. Doesn't seem to bother the PCM any as it sets no codes, but I wonder what happens when the log gets "full"? I think its only invoked for a full clean sweep of the flash, but Im not 100% sure.

 

FWIW, HP Tuners has some info on archive regarding tuning with these. My 411 XDF's are not too different from what they show, but FYI HP Tuners uses the factory nomenclature since they derive their tuning defs directly from the factory supplied calibration info from GM.

Also I have yet to make XDFs for the unified '02 OS. So far mine only support the '01 PCMs.

 

Only available from AVT at the moment, as far as I know. http://www.avt-hq.com/products.htm#AVT-852 The USB one is the one you want since it supports the vcom port that's used by me and Tuner Pro.

Send an email and ask for a quote. Once you have the RFQ, then you can order the cable. Not sure what the pricing is these days, but I recall mine being around $250 or so.

 

Ok just about finished with the testing. Unlike the black box these PCMs dont give much feedback. Blackbox will do full diagnostics. On these the only mode $A2 frames it ever sends are calibration or OS missing, so had to rewrite that part of the app to take all the other logic out.

Any other errors such as faulty checksums or RAM failures are handled as actual DTC's and an SES. Only way to know if your checksum is wrong is to turn the key. In the event of a consecutive bad checksum, it looks like the PCM disables the fuel pump relay from the code. On the OBD side it still sends the usual "heartbeat" frame and everything looks normal when I purposefully corrupt the calibration.

If you have used one of these PCMs, maybe you can chime in to verify.

 

Without further ado here it is:

(Note: A PC or tablet with Windows 7 or higher and USB AVT cable are required)

 

This version has been tested for all foreseeable issues with my own PCM and flashes and does recoveries from faulty flashes, but I have not tested it on a large population of PCMs, so use caution (ie dont try it if you have to go to work tomorrow! :/) It should support at least 01/02 LS1 PCMs. All the 512k PCMs use the same flash structure and logic, so odds are if it unlocks and goes into flash mode, it should work OK.

The flash app requires that you use a complete, unencrypted bin. Before doing ANYTHING, you must download your current bin to work off of.

To do so:

1) Select your current com port for the AVT, usually something other than COM1. The COM port will appear in the drop-down list as soon as the PC recognizes the cable.

2) Click connect, and then start flash mode once you see frames come up in the console window. The app should ultimately say "In flash mode". If not then likely that the security key is not yet supported.

3) Click File > Save Bin from Flash. The app will download the bin and after a few minutes when complete give a dialog box asking where to save the bin to. Select a safe place as this will be your base bin to tune off of.

Note: this app only works for the 512K PCMs, not the 1M ones.

 

To write a bin:

1) Connect and start flash mode as above.

2) Make sure your battery has at least 12.4V! If its less than that, the flash chip could lock during the reflash.

3) Select File > Open Bin to Flash. A dialog box will come up asking for the bin. This must be a full unencrypted bin. Select the one you were using to tune and then the app will start reflashing the calibration.

If the flash fails: Check the battery is fully charged and try again. The app can enter recovery mode by reconnecting to the PCM and repeat the flash. If the flash still fails try DL'ing the bin again and compare to your old one using a hex editor. If there are no changes (ie erased or altered data) then the app is not compatible with your platform or the PCM has a hardware fault.

 

Does this mean its not recommended to use this in conjunction with a bench harness with a +12v supply?

 

At long last, people now have a choice to not bend over for the likes of HP Tuners and EFI Live to tune an 0411 or black box. I sure hope those effers that thought charging a fee per vin number for already ridiculously expensive software are cursing loudly right now! Many people will still bend over for this, but we no longer have to put up with such crap if we dont want to.

Thanks Dimented we all owe you big time.

I myself have other hobbies (non car stuff)with projects that I spend a lot of time working on and frequently share the results of hundreds of hours(or more) of my work with the online community freely. My family and friends always ask "are you going to make any money with that?" then sometimes its "why are you wasting your time". Many people dont get it, but projects like this prove that some do.

 

I haven't messed with LS tuning yet but this definitely has me interested now. Thanks for all your hard work!

 

Most supplies will usually deliver more than 12V if they are a wall pack type. Check with a volt meter with the PCM running. If its less than 12.4V it shouldnt be used.

 

Thanks for the info Dimented.

I also want to say thank you very much for the time and effort put into this. Honestly it would have been very easy to simply make this for yourself and not share with anyone. It is very much appreciated that you did not do that. This is what will keep the DIYers going now a days.

After Christmas I will be looking into getting one of the cables to take advantage with this.

Again, Dimented. Thank you very much for all the effort and hours spent making something possible for this.

Hopefully now, the XDFs will start pouring in for the OS compatable with these pcms.

 

No problem. Hope people find it useful

Im really keen to see how it would work in a fourth gen or other later model car. They supposedly have a lot more traffic on the OBD network. The code is flexible regarding interruptions and can vary the frame size, but it would be nice to see if its enough.

 

Would also be cool to start seeing some of the custom OS stuff too. The potential here is HUGE!

 

Yes. The future is up to people that are far smarter than I on the software side.

 

I did a custom OS for my blackbox in the camaro. Rewrote the fueling algo as well as added some idle air control logic to manage the engine RPMs when the car is in motion to make life easier with a stick. Little more involved than the older OBD-1/1.5's since the code is so HUGE it cant be made compilable, so patches have to be added in the free space of the PCM, or code blocks relocated to fit new stuff in.

To really do it right you need a socketed PCM, though, since during initial debugging on large projects you will sometimes lock the PCM up. If you lock one up with the flash chip, you have to open the PCM up and manually jumper an address pin to get the PCM back.

 

BTW, important note about connecting to the PCM. When the PCM first turns on, it will not allow secure access for a short period of time during boot-up. If you try to connect during this time, the app normally should give "Error - Time delay has not expired, wait 30 seconds..." error, but it can also sometimes hang. If it does this, just click disconnect, then connect, and try again.

Reason: there is a bit of a logic flaw in that GM uses the same submode for a time delay reject as well as for a security seed frame, so sometimes there can be ambiguity if the PCM has given a valid response or rejected the request. In this case an end of frame marker is used to tell the difference. The app will not recognize the rejected frame if there is a frame pile-up (lots of data frames pouring in all at once, such as when the PCM boots up). During a pile-up, there will be no end of frame marker between frames to allow the differentiation between a reject response and a valid security seed response.

 

I try to open the application, but it crashes every time on XP SP2 machine.
I think it might need some .NET framework. Any hint what version is required and any other components are needed.
I am thinking of added manual unlocking option with user provided key, if it`s not already done. That way it can be tested on officially unsupported controllers if key is known.

 

I'd be glad to test it, I have a few Gen4 ECMs I can toy with.

Do you have plans to add flash support for 1024 KB LS1 PCMs? I have a bench flash harness, a couple spare PCMs and AVT box to play. I also have a universal programmer so I can recover them if they brick.

Thanks for your work, It's truly appreciated.

 

kur40, this app only works on windows 7 and higher machines. The app was built in VS 2010 C#, and the WPF is not reverse compatible, unfortunately.

 

It would be nice if you could try it out Be interested to see how many different PCMs it can do.

I may add support for the 1024 KB boxes, but I would have to do some reverse engineering on a PCM first. GM handles the RAM and hardware differently in each PCM, such as the output for the +12V Vpp for the flash. Its in a different spot each time (eg. MCU Port F on some, standard I/O on others, etc.). The RAM for user programs is also specific, and has to be known in order for the PCM to accept the flash interface and allow a reflash. As you would expect, they do try to make it somewhat difficult to mess with these

 

Wonder if this would work on my 2004 Yukon. I was looking at efilive at first. Not sure what PCM I have in it.

 

2004 is getting into the CAN bus years, so its likely to be a later generation computer that no longer uses the older VPW standard and MCU based PCMs. In all likelihood I would say it wont, but a check of the PCM part number will tell for sure.

 

I tested the program.
The read option works very good, I saved a .bin from a 411 PCM and it was good without corruption.
However, the write-flash option has an inconvenient: It seems it writes only the calibration, not the full flash.
This is an inconvenient because it bricks the PCM if you flash a .bin from another PCM. I tested it and bricked 2 PCMs (not a problem since I can recover them).
Don't know if this is the intended operation, it seems so because the write operation is very fast, faster than any full flash with another software.

Thanks

 

Dimented, let me know if you'd be willing to get this integrated into TunerPro. =)

 

Hooray!!
I've been looking everywhere for an alternative to the $1000US options for tuning out there.
$270 doesn't seem too horrible for the cable so long as I don't need anything else to program the PCM.

I have an old 98 Firebird PCM (not 0411), would this flash tool work with that, or would I need a 0411 PCM?
And if I need the 0411 PCM, what vehicle is the best bet for a compatible PCM with 512kB?
I can get a:
2001-02 S10 with HWID#09386530
2002 Silverado with HWID#09386530
or 2005 Cadillac with HWID#12583660

Its' going on a 24x SBC 410HSR with 4l60e auto.

 

What PCMs were you trying to program with them? It should not brick them unless the calibration lies outside of the usual bounds of 0x8000-0x20000. The full flash option is available, but its hidden to prevent bricking for two reasons 1) for write speed and 2) to prevent bricking from an incorrect OS write. Normally for changing the tune only the calibration ever needs to be written. Thats how I've structured the flash and on the intended PCMs I have not been able to induce a brick by the calibration only. Did the PCM still send frames after the "brick"? If you go back in, the PCM will return error frames letting you know what happened, which it should do unless the OS lies inside the bounds above, which it should not for the 98+ PCMs. If possible, can you try again and reconnect after the "brick" and post a screen cap of the console pane? Also, if you hit "Exit flash" after a flash, the software will check for common errors and return them thru the GUI.

To access a full write: Go to the bottom lower left hand corner of the window right next to the window border and double click. This will bring up the advanced menu pane, and from there you can check off flash OS. You will need to do the write step in two steps. First the calibration, and then check off the flash OS check box and flash again.

Edit: See my response below for doing another bin for another PCM. BTW, does the app work for reflashing the existing bin?

 

Montecarlodrag: Here is were you need to click for the advanced, but since it doesnt work correctly Id hold off on a full flash since it may perma-brick and not be recoverable.

Also, are these HP-Tuner programmed PCMs? If yes, you will need to do a complete wipe and reflash since HP does some stuff to the PCMs to lock them. This will have implications since the PCMs may not interface with HP since they will be back to the factory state.

 

I missed that part the first time. Yeah, that will probably cause the PCM to not boot with the cal only if your changing to another OS from another PCM. As long as you can verify that the bin is completly uncompressed and not altered, the full flash should work. As I said it will need to be done in two steps using the advanced feature for the OS since an OS write is not desirable unless you want to change the OS to something else. When doing them both, dont exit out of the utility between flashes, but do them one after the other and the PCM will be fully flashed. While I have not had an OS flash fail, be forwarned that if it really does brick, you will have to open the PCM up to manually reset it. Right now it sounds like the PCM is just having a mismatch in the calibration, and returning an error.

 

The flash app can do up to the 2003 PCMs, but right now the TP defs are limited. After 2003 its CAN bus and the PCMs are quite different and wont connect. I have definitions for the 2001 PCMs, but none for the 2002 yet. I need to convert them over at some point. Also for a V8 app stick to the V8 PCMs since the V6's have different HW.

 

I can pick up 0411's from S-10's easy and very inexpensively, they are relatively plentiful at pick-n-pulls for around $30.00 where I live. V8 0411's not so much. I was under the impression I could just copy the whole OS and everything to start, and then after that just do the cal. Is there more that I have failed to consider?

 

Some of the later 02' and up PCMs have the unified OS, so you could try with a V6 PCM and use a complete V8 cal. There are various option flags that set the TPU (Timing Processing Unit) up for either a V6 or V8 engine timing events in the calibration. The TPU has its own microcode, and there could be differences. Also GM sometimes leaves out hardware such as drivers, output bypass caps, etc. in applications were they are not used to save money. Basically since its just a matter of the pick and place machine not placing them on a batch of PCBs its not too hard to do.

 

ok this is something I hadnt realized. Coming from OBD1 where say a '730 for example is the same regardless of if it was on a 4, 6 or 8.
Of course having to spend a bit more for PCM's wont stop me from going down this road, I though I was going to be able to do this a little bit cheaper :\

 

I found that out the hard way with the old P5 PCMs when I was writing the TBI MAF code. Couldn't figure out why the version with the 4L60-E relocated VSS only worked on the 8625 and not the 7427. Turns out the 8625 was the only one that had all the I/O hardware installed. Other one had the silk screen, pads and traces but no components installed.

 

One thing I've done, but I have TCII unlimited original version, is that I've re-flashed at least 15 0411 PCM's from V6 and V8 cars and trucks to the 0411 operating system for people, and have not had the first issue, but as I said, I do have original version of TCII and cable.
They might so something different.

 

Dimented24x7,
I have a question regarding how you did your 4x block transfers. I am guessing that you are using the full 4112 KB buffer space to do the transfer. In order to make the buffer this size I can't use the AVR 328P chip with only 2K of memory. The 328P hardware is available for around $5. I am using a larger chip but it is a TQFP package.

Is it possible to add an option that allows the end user to select the VPW 4x block mode buffer size in the advanced option menu? Making it (1K+16) to (4K+16) selectable would be great and I don't see it making a big impact to the speed of a CAL write/read.

I am stilling working the AVR code. I went from PIO VPW receive to interrupt driven.