Flash Protocol

[Hera]

Well, everyone for shitz and giggles, I decided to monitor the serial port on my computer during a program of a PCM using the programmer that I have.. I found some very good news.. Here is just a little of the log file that I captured...


]Tx 30 00 04 8C FE F0 3F 13 0.....?.
Tx 30 10 0C 6D 10 F0 36 00 0..m..6.
10 00 FF 80 00

F1 8F 02 .......


Rx 31 1
Rx 00 .
Rx 06 .
Rx 6C F0 10 76 00 73 74 l..v.st


The Green portion is the command sent to the programmer to tell it to pass the data along. Then comes the data, which I did not include because this post would have been very large. Next, the yellow is I believe a calculated checksum for the command and data.

Then we have the blue, which is the information from either the tool or the PCM or Both that says everything is okay and send some more data...

there is also some different initization stuff at the very beginning of the program...

Basically, I have figured out how to capture the PCM code directly from the programmer, I now have the command required to write the info to the PCM for this particular programmer.

With information, I can write a Loader program for this programmer and use it to load my PCM and others...

These commands are most likely just for this brand of programmer, but it can be done...


Kevin

[RoboGeek]

you da man!!
I'm just starting to get my stuff set up so I'll shortly be looking into some goodies..
Does your programmer just flash the PCM with the GM files? Is this a computer program or a stand-alone your using?

[Hera]

actually, there is a interface program for the device, then it uses GM SPS software... I sniffed the serial port, while doing a program to the PCM. And that is what I came up with...

I am having trouble with my serial monitor program.. Then one I like, doesn't work anymore unless I purchase it which would cost 70.. I have tried a few others and they have come up short.. but I will keep trying different things... dunno

Kevin

[Keith@HPTuners]

Excellent find Kevin!

Keep up the good work.. I hope to be doing the same thing perhaps over winter break.

I have a few com port capturers.. haven't tested them out yet though. I'll let ya know how they work though when I do.

[Hera]

Hey magnus, do you have the GM expertec software for you tech II? If you need it let me know...

One other thing, the GM expertec only sends 4112 bytes of data at a time, that includes the command, and checksum...

Kevin

[ls1tools]

I am having trouble with my serial monitor program.. Then one I like, doesn't work anymore unless I purchase it which would cost 70.. I have tried a few others and they have come up short.. but I will keep trying different things... dunno

I have always used portmon and it works fine for me.
But then I have never logged a reflash session with portmon so I do not know if it would work.
http://www.sysinternals.com/ntw2k/fr.../portmon.shtml

Regards
Paul

[ls1tools]

]Tx 30 00 04 8C FE F0 3F 13 0.....?.
Tx 30 10 0C 6D 10 F0 36 00 0..m..6.
10 00 FF 80 00

F1 8F 02 .......


Rx 31 1
Rx 00 .
Rx 06 .
Rx 6C F0 10 76 00 73 74 l..v.st


These commands are most likely just for this brand of programmer, but it can be done...


Kevin

From my *extremely* limited understanding of the commands used to reflash...

8C FE F0 3F 13 30 10 0C
This command looks like a broadcast command from the PC to ALL nodes on the J1850 bus.
The first byte: 8C contains the bits:
100 = priority 4
0 = 3 byte header
1 = IFR not allowed (always for GM)
1 = Physical addressing
00 = Node to Node addressing
The physical addressing is from node $F0 (the PC) to node $FE (broadcast address - all nodes).
The command is $3F (Scan tool is present)
I do not know what the 30 10 0C is for.

6D 10 F0 36 00 10 00 FF 80 00
This command is a command from the PC to the PCM. The first byte: 6D contains the bits:
011 = priority 3
0 = 3 byte header
1 = IFR not allowed (always for GM)
1 = Physical addressing
01 = Manufacturer reserved addressing
The physical addressing is from node $F0 (the PC) to node $10 (the PCM).
The command is $36 (Data transfer)
I do not know what the 00 10 00 FF 80 00 is for - but I'm guessing it is some form of memory address and buffer size.

There MUST be a previous command to tell the PCM which direction the data transfer should take. It will be of the form: 6x 10 F0 34 (download tool to PCM) or
6x 10 F0 35 (upload PCM to tool)

6C F0 10 76 00 73 74
This command is a command from the PCM to the PC. The first byte: 6C contains the bits:
011 = priority 3
0 = 3 byte header
1 = IFR not allowed (always for GM)
1 = Physical addressing
00 = node to node addressing
The physical addressing is from node $10 (the PCM) to node $F0 (the PC) .
The command is $76 (Successful response to command $36)
I do not know what the 00 73 74 is for.

Hope that helps in some small way.

Regards
Paul

[Hera]

I am not sure if those commands are directed completely on to the obd2 bus... I don't know if anything there is just for the programmer.. If they were directed on to the obd2 bus then it is possible to dump the contents of the PCM.. But I don't know for sure..

Will have to experiment...

Kevin

[The_Highlander]

The BB elec cable will not work

IT does not have enough buffer to do the block trasnfer as the PCM needs it...

THe PCM needs to get into 4x mode and 1x mode...

The thing is:

We need a cable that does support enough buffer for the transfer and 4x.

b&b will be releasing a new converter in the next few months.. I spoke to joe.

I believe that the TTSPowersystems obdii cable does support all this ..but not sure about it..

Thanks

[RoboGeek]

yea.. buffers do seem to be an issue.. although I still think a loader that can take that into account might be feasable. I just dont know how the PCM will react to it.
I can see data collisions in my nightmares already..

[The_Highlander]

Has anyone come up with a cable that works?????
???
???

[Keith@HPTuners]

carputing.

[RoboGeek]

I sense a mad rush to their website as we speak...

[Keith@HPTuners]

well.... carputings cables only work for carputings ls1 edit software.

We could always write software for their cables though.. which shouldn't be too hard.... BUT.. i won't go there.

[RoboGeek]

I'm more interested in what chip they use.. we can design our own then.
I spoke to Dave over there at carputing as while ago.. the cables are only available with the software. That makes them pretty expensive cables!

We can always do a PIC controller type thing for the cable if we need to.. I think we could do just about any buffer we wanted then.. although I havent really checked into that aspect yet. Plus I still dont know the max size needed.

[jimter]

I found a interface and software that should do what we need, now who wants to spend $1600.00

http://www.dgtech.com/products/jnat.phtml

[Guest]

Man, ... lost my original email...
...but what i WAS saying, is that this shouldn't be too hard to do... as a matter of fact, I'm actually doing something like this right now.... only, I'm not supporting 4x becuase I didnt' forsee a need for it... Do you think 4x is neccesary? If a programmer is cautious of the cpu timing, etc,... it shouldn't be to hard for 4x. (is 4x neccesary?)

My little design will do entire frame lengths, then send it out to the rs-232, and from that, the computer can choose what it wants to do with it... It has a build in menu for power up configuration options, pre-defined message storage (16 total), and auto crc creation.

Which makes me think of a quistion that someone might be able to answer real quick... Usually, what can I expect for a response time for the vehicle, after my End of Frame?

[ls1tools]

My little design will do entire frame lengths, then send it out to the rs-232, and from that, the computer can choose what it wants to do with it

Do you mean your interface will transmit as many characters as the host PC supplies? Up to say 4096 bytes?

Which makes me think of a quistion that someone might be able to answer real quick... Usually, what can I expect for a response time for the vehicle, after my End of Frame?

The EOF symbol is 280 micro seconds.
The EOF symbol transitions into the IFS (Inter Frame Seperator) which is 300 micro seconds (20 micro seconds appended on the end of the EOF symbol).
So basically there is at least 300 microseconds between the end of one frame and the start of the next.
Except under one condition - if a rising edge is detected between 280 microseconds and 300 miscroseconds then nodes may begin transmitting. Sort of like one node makes a false start just before the end of the IFS time so everyone is allowed to go.
Obviously if more then one node starts transmitting at the same time then arbitration will occur and only one message will survive.

On the other hand you may be asking what is the message schedule on the bus as transmitted by ALL the GM modules?
A really "busy" message schedule like on the C5 is between 3..10 messages per second depending on what data needs to be moved across the bus. A really quiet message schedule is about 1 message every 3-4 seconds.

Regards
Paul

[ls1tools]

Which makes me think of a quistion that someone might be able to answer real quick... Usually, what can I expect for a response time for the vehicle, after my End of Frame?

Arrgghhh! Just re-read the question.

SAE spec say: a response from the vehicle must be received within 100ms or the scan tool can assume no response was/will be sent.
In reality it's normally between 10 and 40 ms

Some more timing info:

Multiple responses will be sent at 10 or 20 ms spacings like this:
09:40:19.758: Send: $01,$01,$40,$05,$68,$6A,$F1,$06,$02,$12
09:40:19.788: Recv: $01,$01,$C0,$0A,$48,$6B,$10,$46,$02,$84,$00,$00,$0 0,$00,$5B
09:40:19.808: Recv: $01,$01,$C0,$0A,$48,$6B,$10,$46,$02,$26,$00,$00,$0 0,$00,$FD
09:40:19.818: Recv: $01,$01,$C0,$0A,$48,$6B,$10,$46,$02,$36,$00,$00,$0 0,$00,$0D
09:40:19.828: Recv: $01,$01,$C0,$0A,$48,$6B,$10,$46,$02,$C6,$00,$00,$0 0,$00,$9D
09:40:19.838: Recv: $01,$01,$C0,$0A,$48,$6B,$10,$46,$02,$90,$00,$00,$0 0,$00,$67
09:40:19.858: Recv: $01,$01,$C0,$0A,$48,$6B,$10,$46,$02,$20,$00,$00,$0 0,$00,$F7
09:40:19.868: Recv: $01,$01,$C0,$0A,$48,$6B,$10,$46,$02,$B0,$00,$00,$0 0,$00,$87
09:40:19.878: Recv: $01,$01,$C0,$0A,$48,$6B,$10,$46,$02,$C0,$00,$00,$0 0,$00,$97
09:40:19.888: Recv: $01,$01,$C0,$0A,$48,$6B,$10,$46,$02,$12,$00,$00,$0 0,$00,$E9
09:40:19.908: Recv: $01,$01,$C0,$0A,$48,$6B,$10,$46,$02,$91,$00,$00,$0 0,$00,$68
09:40:19.918: Recv: $01,$01,$C0,$0A,$48,$6B,$10,$46,$02,$21,$00,$00,$0 0,$00,$F8
09:40:19.928: Recv: $01,$01,$C0,$0A,$48,$6B,$10,$46,$02,$31,$00,$00,$0 0,$00,$08

Theoretical limit of the J1850 bus is 100 messages per second.

Math:
SOF=200us
long pulse = 128us
short pulse=64us
so use average pulse = (64+128)/2
IFS=300us

SOF+(12-bytes*8-bits)+IFS
200+(12*8*(64+128)/2)+300 = 9216us = 9.216ms per message.
Obviously faster for shorter frames.

Regards
Paul

[Tyrithe]

Robogeek:

I'm more with the Atmel chips myself. But I've been wondering about doing something with one of the MegaAVR 128 chips. Can interface external RAM up to I think 64k. Need a larger buffer than that?

Design is coming along ok, but assembly and then testing will be an issue. I don't have a laptop I can fire up in my car.

Tyrithe