reflash P59 tac module

They go by many names, P01, P59, VPW, '0411 etc. Also covering E38 and newer here.
RADustin
Posts: 162
Joined: Fri Oct 17, 2014 9:44 am

Re: reflash P59 tac module

Post by RADustin »

antus wrote:I am not sure about US cars, but in Australia the BCM was the ALDL bus master and sends out a heartbeat every so often. Thats 3 bytes long and every module in the car waits for the heart beat then I believe it has timing hard coded so that all modules in the car transmit one after the other. Then there is a short gap at the end, which is just long enough for a tool to detect 50ms silence, then send a silence chatter to take over the bus. This is for the ecm, bcm, abs, dash etc on the standard bus. Then for SRS, thats on its own bus, and a command is sent to the BCM to bridge the two ALDL busses to make it available for a short time. Being we are talking TAC module here, I would suspect its quite possible that its on its own bus, too. if it really is ALDL it should have ALDL checksums though, I cant see that something important like TAC would have no error detection. I raw dump of all serial traffic would be good, then check the frames by hand to see if the tools can be trusted, or what else is going on.

looking at the raw logs above, I dont think thats ALDL. ALDL is Device ID, Length ($55+length), mode, submode, payload, checksum and none of those look like they fit that format.
agreed, I don't think it is ALDL format. I do think it is 8192 UART, but it's own specific formatting. Although it does appear the PCM potentially outputs a 3 byte 'heartbeat' but really I think this is just some sort of handshake and it running the bus as a master. Without the PCM sending these messages, the TAC does nothing. I intend to connect directly to TAC without PCM and send it a few of the PCM messages on a reoccurring bias to see if I can get it to chatter back with me- just for fun.

This guy was my initial tip off of the 8192 speed of the PCM-> TAC coms-
https://www.fiero.nl/forum/Archives/Arc ... 26679.html

and so far I'm confident the PCM-TAC coms are 8192 baud, but not ALDL format/structure. Maybe this is why the MDI fails to work. If it's preprogrammed for a standard format and we are working with an ad-hoc format here.

If I wanted to pursue a logging tool for this line, I think I can use the short gaps between messages to align the parsing. Evenso, my objective isn't really to understand this communication. Being that the communications aren't true ALDL, I don't think the TAC will ROM dump over the ALDL line, but I can try later on today to send it a few commands and see if I can get an answer.

Does anyone have an idea how to identify the chip on the TAC module? the 80pin...? I posted the numbers found on the chip in a previous post. As far as manufacturer, it just says Japan so I'm really not sure where to start looking to understand what datasheet might be applicable. Would really appreciate some assistances in ID'ing the chip. Thanks!
bbmike
Posts: 45
Joined: Thu Apr 02, 2015 1:10 pm
cars: Too many!!

Re: reflash P59 tac module

Post by bbmike »

RADustin
Posts: 162
Joined: Fri Oct 17, 2014 9:44 am

Re: reflash P59 tac module

Post by RADustin »

bbmike wrote:Might be a renesas h8/3038. https://www.renesas.com/us/en/products/ ... -promotion
I think you nailed it.

unfortunately though I don't think it supports JTAG? I forget how old some of this stuff is. Looks like I need some type of universal PROM programmer.
RADustin
Posts: 162
Joined: Fri Oct 17, 2014 9:44 am

Re: reflash P59 tac module

Post by RADustin »

got the renesas FDT running and chip connected through a 5v FTDI adapter. Set the chip in mode 7(it's already set on the board with all mode pins set high), trying to use user programming mode so I can attempt a read without wiping it. I can't get it to connect yet, but I'll keep working on it. Got to be close I'd think. If the 3039 files will work to connect to it then I can probably modify the setup files for the smaller flash size of the 3038.
FDT Setup.png
bubba2533
Posts: 498
Joined: Wed Apr 11, 2018 8:50 am
cars: 03 Chevy S10 Turbo V6

Re: reflash P59 tac module

Post by bubba2533 »

If you have the hardware to log the bus activity and query the pcm with this ram dump utility maybe you could find an address where the pcm is storing the read/send packets.

That assumes it’s storing the data in an address space where that utility has read access. The pcm operating system ram read function could be modified to allow it access to higher address regions, but I haven’t needed it.
LS1 Boost OS V3 Here. For feature suggestions post in here Development Thread. Support future development ->Patreon.
RADustin
Posts: 162
Joined: Fri Oct 17, 2014 9:44 am

Re: reflash P59 tac module

Post by RADustin »

bubba2533 wrote:If you have the hardware to log the bus activity and query the pcm with this ram dump utility maybe you could find an address where the pcm is storing the read/send packets.

That assumes it’s storing the data in an address space where that utility has read access. The pcm operating system ram read function could be modified to allow it access to higher address regions, but I haven’t needed it.
I'll look into this and see what can be learned.

I really want a TAC dump though lol. I tried a bunch of settings in the old hitachi/renenas tool but can't get anything up and running. :comp:

I'm after a few different DBW parameters. Ex- how a TPS mismatch is handled....is it in the TAC or PCM? ect..
User avatar
Gampy
Posts: 2330
Joined: Sat Dec 15, 2018 7:38 am

Re: reflash P59 tac module

Post by Gampy »

VPWExplorer Ram Dump is part of PCM Hammer release 021.

-Enjoy
Intelligence is in the details!

It is easier not to learn bad habits, then it is to break them!

If I was here to win a popularity contest, their would be no point, so I wouldn't be here!
RADustin
Posts: 162
Joined: Fri Oct 17, 2014 9:44 am

Re: reflash P59 tac module

Post by RADustin »

Gampy wrote:VPWExplorer Ram Dump is part of PCM Hammer release 021.

-Enjoy
I was able to quickly get a RAM dump yesterday and find both PCM and TAC messages in RAM. So that really simplifies things quickly.

I was using the logger within universal patcher to log the RAM spots I found but it is very slow. Is there a faster option available? EFILive can log ram super quick...
kur4o
Posts: 948
Joined: Sun Apr 10, 2016 9:20 pm

Re: reflash P59 tac module

Post by kur4o »

The fastest method for reading ram is using mode 23.
It reads 4 bytes per message. and you can get it every 10-15ms,
Logging 6 bytes of ram can go as fast as 60fps, but even if you have 60fps rate the values are not updated in the pcm fast enough than 25-50ms.

Which method you are using for logging ram in universal patcher, how many bytes and what rate you got.

A simple m23 script will be much better option.

What ranges you need log, I can do some quick loop script to dump it in console.
RADustin
Posts: 162
Joined: Fri Oct 17, 2014 9:44 am

Re: reflash P59 tac module

Post by RADustin »

kur4o wrote:The fastest method for reading ram is using mode 23.
It reads 4 bytes per message. and you can get it every 10-15ms,
Logging 6 bytes of ram can go as fast as 60fps, but even if you have 60fps rate the values are not updated in the pcm fast enough than 25-50ms.

Which method you are using for logging ram in universal patcher, how many bytes and what rate you got.

A simple m23 script will be much better option.

What ranges you need log, I can do some quick loop script to dump it in console.
yeah I noticed efilive is using mode23.

I really only need 7 bytes on the TAC coms, but I was logging 8.
PCM_TAC messages .png
PCM_TAC messages .png (23.78 KiB) Viewed 1779 times
Post Reply