This is Important-Seriously

[Guest Greg Ross]

This comes from a post today from Sir Padgett from discussion with Sahein and 2Seater and we need help;

[color:"purple"] What we need are

1) A 20-something CS or CT grad knowlegable in assembly language, interested in retuning cars, and who has a lot of spare time (I avoid the "H" word).

2) Someone in GM who can find the programming information or memory maps, or mnemonics/locations for 88-94 "P4" 3800 ECMs and Reatta BCMs

Those of you interested in the long term maintainability (that should include everyone) of these vehicles, and from the electronics point of view, we need to capture and be able to manage and repair/ rework this Data.

I don't see this as just a Hop-up option opportunity, if these vehicles are going to stay on the road the E-Body specific Electronics Modules are going to need a knowledge base.

I rather doubt the General will ever officially give this info up but like the FSM Issue that's been a Hot Topic, I don't make any distinction about "Lines of Programming" and maintainance data. This is old technology in automotive terms and I wouldn't think considered particularly valuable (I could be wrong though)

Who do we know, who can approach GM on this basis of maintainability, or/ and

Are there any candidates who have the skills and who'd take on the challenge from Padgett.

I realize there's a cultural thing here with intellectual property/ proprietry rights, what-ever!

Barney, help, where do we go with this appeal?

Greg

[padgett]

If we can find the personnel & a data source, I would be glad to mentor/advise and even provide some equipment/software. Could burn a CD of what I have now (several Mb) but it is not collated.

BTW the changes I have made to my car (mostly to lower engine temperatures) were more for long term drivability, reliability and longetivity given the nature of today's fuels and operating conditions and to incorperate certain changes that the factory made as updates. Nothing has been done to inhibit CC light off or emission control.

[2seater]

I for one really appreciate the support, for somewhat selfish reasons, and perserverance will eventually pay off. Fastchips does list "custom programming" available for $350, but I would have to be able to tell them what I want, and therein lies the problem. What I am looking for is certainly worth something, but cut and try would get very expensive and time consuming to boot. For about the same price I can purchase a good alcohol injection system, but of course there is no guarantee this will totally solve the problem. Input is always appreciated. <img src="http://www.aaca.org/ubbthreads/images/graemlins/smile.gif" alt="" />

[Guest tempest68]

I've been in IT for 13 years, but haven't touched assembler in the last 10 years. Why assembler? Is there source code you need someone to go through and interpret? Or are you looking for something to be written? If needing something written, is assembler the only way to go or could someone do what's needed in C (havent touched that in awhile either) or Perl (dont touch it much, but my favorite language) or Java (learning it right now).

mailto:jim_dearment@hotmail.com

[padgett]

What we have is a computer and the prom that contains its programming. By using a programmer we can dump the contents in binary format.

The original code may have been written in a high level language (doubt it) but we have no access to the source code, only a dump.

By using a disassembler we can convert the binary to assembly code. Also we have a pretty good idea of what/where many of the variables are located (in general data/tables/variables are in the first 1500h bytes and the program is in the rest). Total memory size is 32k bytes.

This is why I said it is a lot like disassembling a virus except that we do not have commenting disassembers like SOURCER or ADA available. The good news is that a lot of people have been looking at a lot of ECMs for almost 20 years. The '727 is probably the most modified ECM around. And the general does many things the same way in all of them.

The bad news is that other than the GNs which used a completely different computer (same CPU but very different organization) few people have had any interest in the Series I 3800 engines.

Now I have a *lot* of notes and some commented code/maps but is only about 50% done - there are a lot of gaps (and you can't just plug in frog DNA).

Twenty years ago it was the type of thing I loved to do but my day job just takes too much time now and am rarely home.

[Guest tempest68]

Been away over the weekend and dont have car or shop manual handy. Would the processor happen to be of the 68HC11 variety? If so, look here (http://www.dewtronics.com/projects/m6811dis/).

I emailed the guy, and he wasnt sure if our 3800's used this chip too or not. If its the same chip, his disassembler should help.

[padgett]

Yes ECM and BCM ate Motorolla 68xx based (68HC11 specifically). Tuner Cat also has a good disassembler.

[Tinker]

Hi Padgett, Brian here in northern Illinois.

I think you said in one of your posts, "anything can be found on the internet."

Try plugging-Motorola 68hc11 Disassembler-into your search engine.

Google returned 709 hits for me, here's a couple you might be interested in:

http://www.techedge.com.au/utils/dhc11.htm

http://www.bd.thrijswijk.nl/thrsim11thrsim11.htm

I worked with the Motorola 6801 processor on a feasibility study for using them to control locomotives back in the late 70's or so. We converted an old f-7 unit and I got into machine code a lot during that project so, I know what your up against trying to decode the reatta.

Hope I pointed you in the right direction. There are a lot of links to people who wrote books on the 68hc11 maybe someone will give you some help.

[padgett]

Folks maybe a little background would help as things seem to be getting a little confused here.

Getting a disassembler is not a problem, a number of years ago what I did was to write microcode, disassemblers, and cross compilers for embedded military processors (e.g. Mil-Std 1750(a), Z-80, Amd 2801 bit slice) - were flying the F-16 in 1975 on 32k of memory. Around 1983-4 I wrote a disassembler for the 6809 used by GM in the first CCC ECMs. Unfortunately my copy is on 1600 bpi tape and is for a VAX. (Is an interesting story about how the GM order held up the intro of the Macintosh).

The place to start is really the Motorolla application notes for the 6800 family (as noted the one in our Reattas is a 68HC11 from Hitachi which has specific on board RAM and such.

So disassembling the code is not difficult once you have a memory dump but what you get is not the original source or comments but the raw disassembly - lots of loads and store and compares and jumps and such but not a clue what is being manipulated or why.

Now the ECM memory space is devided into four areas: registers, RAM, memory mapped I/O, and the PROM. In the case of the 1228253 this is a 27C256 PROM which occupies the memory from 8000h to FFFFh (first you need to learn to think in hexadecimal).

To make an intelligent disassembly you need to map which variables ar in which RAM locations, which ports the different inputs come into and in what form, what fixed values go where (the bottom 4k-4.5k of the PROM) and only then will the dump become intelligable.

Now a *lot* of work has been done over the last 20 years by a lot of talented people, GMECM (the lists and archives) is full of data, mostly for different engines. The good news is that the general doesn't change things very often.

For example the error codes map into memory in the same order they appear - 13,14,15, etc. So if you know where they are stored you can scan a dissassembly for references to that bit in that location. With a little luck they will point to the right code.

Most people start with the fixed values - the spark advance, where the fans turn on and off, the mixture tables, the MAF tables - these are pretty well mapped and when you see a "performance chip" usually they have diddled these values. That is the easiest part.

Two turn off the incessant error codes for the transaxle Greg no longer had I could not just flip the bits, the program flips them right back - I had to find where in the program the bits were being flipped and turn that off. This is more difficult but still relatively simple. In a couple of places where the computer flipped the error codes, it also took action (dropped out of closed loop) so I had to disable those also.

Now we are looking at changing entire tables to extend the MAF for boosted operation. This is getting into the "be real careful" area since mistakes here can have severe consequences. Fortunately we have found someone who has already done it and whose engine seems to be surviving.

My problem is not a lack of knowlege or resources but time. This morning I was in DC, now in WVA, both far from my car and garage.

Ideally we would find someone with more time availabe and operating from a fixed location. Even better would be the actual GM tuning maps for the Reatta but while that would be nice, we have enough information to do the job, it is just going to take a while.

Would be nice if someone could simply collate all of the information gatehered already - several megabytes worth but do not let the small size fool you - these are not WORD documents but raw binary and text files.

I will be home for a few days and could try to cut a few CDs. Anyone interested can send me a Master Boot Record they have written for a PC as a resume <img src="http://www.aaca.org/ubbthreads/images/graemlins/cool.gif" alt="" />

[Tinker]

Oh, I see.