ECM Code

[VetteVet]

Hello All,

Has anyone on here other than Todd P. done any reverse engineering of any of the ECM code masks?

I'm about 50-60% done with my 1991 BFXB code. A quick peek at the code for the other years leads me to believe that they will fall like dominoes once I get finished with BFXB.

I'm just looking for anyone who might be interested in collaborating with me on this. Motorola 6811 experience would be a plus.

My goal is to completely understand the inner workings of the ECM, identify additional constants and tables that can be used in tuning, and lastly, to modify the code for added/improved functionality.

Jep

[XfireZ51]

Jep,

Were going to send me what you have so I could compare to the 92 stuff I have?

[VetteVet]

Dominic,

Let me load up the 92 code and trace through to verify the locations for the additional constants/tables that I have identified. I'll get this to you as soon as I can.

Jep

[XfireZ51]

Dominic,

Let me load up the 92 code and trace through to verify the locations for the additional constants/tables that I have identified. I'll get this to you as soon as I can.

Jep

Check.

[tpepmeie]

My $0.02 on this topic...

I've got fully commented source code for the 91 BFXB, and most of one done for 93 BMCB, as well as the calibration information for all the other years. It was excruciatingly time consuming, but five years ago, I had plenty of time.

Aside from the 'neat factor' of having the data, I can honestly say it was not time well spent. After trying all sorts of code modifications you can imagine (closed loop lambda control, 2-stage rev limit, custom data streams, etc. etc.), I have come to the conclusion that the factory calibrations are pretty damn good. Thus, on the 427, I'll be using the BMCB calibration with just a few basic modifications.

We'll have to see how it runs, and I do get the wild ideas to do other novel stuff, but nowhere near the time to do it. At the end of the day, the factory calibrations are more than tuneable enough. Assuming you have access to all the tables and variables. That part is useful, because the commercial tuning software just show a fraction of the variables.

Happy to help anybody who's heading down this road. Been there, done that. :cheers:

Todd

[-=Jeff=-]

What would be nice is to find an empty Analog input on the ECM that you can feed a WBO2 into and then log it by changing one for the variables on the ALDL Data stream ( like the battery data)

if someone has done most of this then why are others just doing it again? why not share between each other.. or share with all

[XfireZ51]

What would be nice is to find an empty Analog input on the ECM that you can feed a WBO2 into and then log it by changing one for the variables on the ALDL Data stream ( like the battery data)

if someone has done most of this then why are others just doing it again? why not share between each other.. or share with all

Jeff,

Here's another simple example. EASE scantool only records RPM up to
6300rpm. However, ECM does report actual rpm and I have a datastream mod that gives that raw data. Otherwise, I lose datapoints in the sweetspot of
LT-5 performance band. I can think of some code mods that would be of interest to have that you could find for instance in Rob Rauscher's EBL code.

[VetteVet]

Jeff/Dominic,

Any datastream mods should be doable without a problem.

Jeff,

Find me an unused analog input on your 1990 and I can do the code mods for you. Is sampled WBO2 voltage OK? I could probably do a lookup table and interpolation to output the actual AFR, but it would make the mod sensor dependant and would add to the load on the processor. I haven't gotten to the point yet that I'm actually looking at processor load, but my guess is that these ECMs are operating without a whole lot of headroom.

Jeff

[XfireZ51]

Jeff/Dominic,

Any datastream mods should be doable without a problem.

Jeff,

Find me an unused analog input on your 1990 and I can do the code mods for you. Is sampled WBO2 voltage OK? I could probably do a lookup table and interpolation to output the actual AFR, but it would make the mod sensor dependant and would add to the load on the processor. I haven't gotten to the point yet that I'm actually looking at processor load, but my guess is that these ECMs are operating without a whole lot of headroom.

Jeff

EBL has A/D inputs and I was able to get my ZT-2 into that datastream. In addition EBL would allow you to specify what the WB response curve was
ie Zeitronix or Innovate.

[-=Jeff=-]

No problem Vettevet.. no rush either, I am no position to do anything with a WBO2. I also need to figure out if any inputs are avail. I know on the 7727 there was at least one extra and guys at thirdgen added the WBO2 input..

Right now I am enjoying driving the car

[tpepmeie]

Did someone say open inputs? There are a few...

Pin (AD ch)
B7 (0x40)
B14 (0x50)
B15 (0x60)
C1 (0x88)... note this is not open on the later models w/ linear EGR
C13 (0x00)
C19 (0x70)

There are a couple others, but the above are configured for 0-5v input, with a reference voltage.

Hope this helps.
Todd

[-=Jeff=-]

C13 is 0x00? just want to confirm

those are all 5 Volts? Cool you could actually set up 2 WBO2s

[XfireZ51]

Did someone say open inputs? There are a few...

Pin (AD ch)
B7 (0x40)
B14 (0x50)
B15 (0x60)
C1 (0x88)... note this is not open on the later models w/ linear EGR
C13 (0x00)
C19 (0x70)

There are a couple others, but the above are configured for 0-5v input, with a reference voltage.

Hope this helps.
Todd

Todd,

Cool. Thx.

[tpepmeie]

C13 is 0x00? just want to confirm


That's what I have in my notes, but I've never tried to use that one, so can't be sure.

[-=Jeff=-]

That's what I have in my notes, but I've never tried to use that one, so can't be sure.

which ones of that list have you tried and confirmed?

Also did not you at one point have WBO2 controlling the car in place of the NBO2s?

[VetteVet]

Todd,

Thanks for the info!!!

Sending you a PM.

Jep