Flash Protocol

[lndshrk]

The 68HC58 isn't a processor.

It's a dual mode DLC. aka VPW data link controller

Designed by Delphi, formerly sold my Motorola

No longer.. I've been working on getting that specific
part back into electronic component "distribution".

FWIW, a lot of the Motorola/Philips chips mentioned above
are just that, transcievers.. NOT DLC's... If your processor
doesn't have DLC in it, you need a DLC *and* a tcvr to
tx/rx a VPW message.

Jim Conforti

PS: A lot of the "GM" protocol is in fact an SAE standard.

The tricky parts will be the "switch over to 4x" stuff and
also the authentication to erase the flash and reprogram

[lndshrk]

OK.. so I did a little snooping around and:

Once you get in security access wise, I think this
is basically the read stuff:

You send:

6C,10,F1,35,01,LH,LL,AH,AM,AL,CS

PCM replies

6C,F1,10,75,01,CS

LH/LL = High/Low Byte of length of data requested
AH/AM/AL = High/Mid/Low Bytes of Address of data

Reply equals happy success (35+40 = 75)

Next, the PCM will reply:

6D,F1,10,36,01,LH,LL,AH,AM,AL,DC,CS

(Note, I think the 6D means Physically Addressed
Block Transfer mode or something like that!)

DC = the XOR checksum (I think) of the data that
you are about to be forcefed.

Then the thing spits "length" bytes of data at you.

You XOR it.. if your XOR and the DC above match you'd
send the following to the PCM:

6C,10,F1,76,00,CS

Indicating that the data was happy.

Now, repeat that for addresses 0x00000 thru 0x80000
and read out an LS1 PCM ;D

The hard part is the "security access" mode 0x27 stuff.

I've already done this for the BMW's and the Mini's, if someone
disassembles a PCM and can find the code for mode 27 I'll be happy
to look at it a bit. I'm (too) familiar with '332 assembler

[Tyrithe]

I don't know if I've missed something or not, but does this request for data happen at normal speed, or at 4x? I'm trying to evaluate BDLC's for this, and most of the ones I find can receive 4x, but not transmit it.

[lndshrk]

Tyrithe,

The only one I have found that does Tx *and* Rx
in 4x mode is the Motorola/Delphi DLC formerly
called the MC68HC58.

As I said, I'm working on getting it into distribution.

That way, us small volume buyers can buy it.

Jim Conforti

[Tyrithe]

I have seen that Infineon has one capable of bidi 4x in their 16 bit line...

Can't find a distribution site for that procecssor either though.

[Keith@HPTuners]

lndshrk, you still following the forum?

I was pouring over some old posts and find the info you posted very interesting.. I'm getting into this stuff right now.. I'm going to see what I can do with an autotap V1 interface.. just for starters, then dip into some more complex things.

[Keith@HPTuners]

Just to add a little more info I obtained from a very helpful friend of mine...

There are sections of the flash you can update outside of the 41.6 block transfer mode, such as: VIN, Manufacturer counter, Software module ID's

To update the CAL's you need to use block transfer mode which only opperates in 41.6K speed.

The default packet size in the PCM is 1K. To change that you have to change the PCM's upload algorithm. This is where a cable with buffer support is needed. If you just use a straight through cable with NO buffer and rely on windows to buffer, you are just asking for problems.

So, you could read your PCM with a straight through cable and just hope windows can collect the data fast enough error free, but it would be a big risk to write this way.

A good calbe would have enough buffer for the entire flash file thus if you encountered a windows problem during the upload process, the cable could still do its job and your PCM wouldn't be toast.

[sean]

is there anyplace i can find the VPW charecter set ? i plan to try building a 68332 bassed cable. m thoughts are that it will be able to handle everything with room to spare. also if you want tpo buffer the entire rom youll need 2.6 megs of ram on the Micro to do that. im bascially trying to build a more advanaced micro to do the job and code the VPW chareter set into a VPW output. but what i need it the pulse vs charecter chart etc to build it. and the 68332 has a tx rx speed 56k so everything is good there.its the converterting the thing to a VPW signal thats gonna prove to be chanllegening.

[Keith@HPTuners]

and scoll down, it has an example from which you can build a chart.

is the J1850 spec that also has implementation info.

Does that help?

[The_Highlander]

I have a log file of the writing process. it could be used to know what to do and what not to do?? anyone have a schematics of a working converter?? email me
[email protected]

bb-elec says that it may be in the near future to upgrade the hardware to do block transfers...

[Guest]

I haven't been on in a while and saw this thread. The 68hc58 DLC is in production and available. Go to:

www.findchips.com

and put xc68hc58 into the search field. It currently shows stock at Area 51, FutureActive, Newark, and Rochester. Newark and FutureActive seem to sell single quantities, about $5 each

[The_Highlander]

Anybody have the schematics of a functional programming cable? LMK

[jdudas]

Guys, forgive my "newbness," but is there any OTHER way to program these newer PCM's? I'm looking into ways to do this, and I'm curious:

- Is the PCM firmware on a programmable chip that we could just pull out and reprogram, or program in circuit? ie. (EE)PROM, or microcontroller with FLASH memory?

- Do devices exist out there (aside from GM proprietary stuff) that allow programming

- Are you doing this for the convenience of not having to pull out the PCM for programming, and economy of doing it over an existing interface...

I'm trying to get a feel for the problem.

Thanks!

[Keith@HPTuners]

Hi Joe. I don't believe your question belongs in the flash protocol thread but I'll answer it here anyway. If you have further questions that don't deal specifically with flash protocol, please start a new thread.

There are other ways to program the PCM other than communicating with the PCM on the class-2 bus.

The PCM is on a flash chip that is soldered onto the PCM itself. It can be removed, reflashed, and resoldered.

GM and Ease both have programming kits that will program a PCM with stock code. It will not upload custom code nor will it allow you to make changes.

We are doing this for convenience. It is much easier to use the Class-2 data bus instead of actually pulling the chip.

[The_Highlander]

My question: cant you use EASE SPS programmer cable and write your own software than can use that cable? Or that is an impossible thing to do?

[RoboGeek]

Yes. If you can write code a cable that is capable of reflashing will work. Sounds simple but the code is where we all pull out hair... ;D

[Keith@HPTuners]

I don't think thats impossible but you need to use their cables packet syntax which you'll have to find out on your own.

I'd just rather see someone develop their own cable.. a standard conversion cable w/buffer so we all can use it.

[Hera]

It is extremely feasible to write your own software for the ease programmer..

Kevin

[lndshrk]

We're all ears.. "feasible" away ;D

[Hera]

Well all the commands so far from sniffing the port are repeatable, I am working with my best friend... a Software programmer, he is gonna help me write some software to utilize it with my own flash... Ease uses it's own control program... then transfers control of the serial port to GM Program, I am gonna write the program in place of GM's program to load my own BIN then program it to the PCM... Once that works, I am gonna work on transfer from the PCM...

kevin