16214848 1996 USA Cadillac Deville PCM information/musings

[300d50]

Hello all,

Just another Yank from the states here, searched far and wide on the US forums and have yet to find much info on this beast.

Service number is 16214848, uses a plug-in knock module #16196410, and is first-year OBD-II.

Came out of a 1996 USA Cadillac Deville with a Northstar V8.

I know it uses a Motorola MC68HC11F1 processor, and has an on-board A28F010 128Kx8 flash memory.

I have not yet pulled the flash to read it since I do not have a spare PCM and my friend doesn't want to risk any remote chance of damage till we have a spare PCM+dash that we can use for the swap we're planning. (The engine is going into an 88 Pontiac Firebird with a T5 trans ).

Most of the information I've found has been sparse, but it seems that it should follow the normal seed/key procedure for gaining escalated security access for reflash, once the algorithim has been figured out.
As far as an initial bootloader, I'm not sure whether the one you guys have coded up for the VX /VYwill be adaptable or if It'll need to be custom made.

To be upfront, the main impetus for opening this beast up is to disable the Passkey-II VATS system so we don't need to stuff the caddy dash cluster pcb and a resistor under the dash of the 88 Firebird the engine is going into...
Cadillac decided to not use a dedicated VATS module with a 50hz sig output, and instead put the resistor reader and starter relay enable circuitry into the cluster, and has it dump a "Passkey-II ok, continue to send in the petrol!" message over the actual Class2 J1850 bus when the correct resistor is read.

Tuning would really be secondary to actually getting the engine running and the auto trans code disabled, but there are plans for twin turbos and a beefier trans down the line.

I have an Tactrix OpenPort 2.0, Moates Ostrich, GQ4x prom/flash burner, logic analyzer, o-scope, a top-end actron code scanner, and a few other tools at my disposal including a full soldering station and hot air rework station.

I do have an ELM bluetooth adapter I can borrow from a friend if needed, or I can buy whatever is known working with the software available. Can never have enough tools...

Anyone who can help shed more light on this, please feel free to add your input if you want to.
Likewise, let me know if I can supply any information to help get this further along.

Hats off to all the hard working, talented, and dedicated petrol heads here!

[antus]

When you get it open can you post up pics of the circuit board? As you say, it sounds kinda similar to our VX/VY flash pcms with that cpu, and a flash chip that size although they arnt OBD2.

[300d50]

I'll have it open again in a few minutes and start the photo shoot, but till then I did find some front/back photos that are available here.
I'm not sure if this is the "early" or "late" version though, will know once the torx screws are out.

I'll edit this post with thumbnailed higher resolution pics once I have them.

I'm pretty certain that the unpopulated header connects into the address/data bus going to the flash/processor, possibly for the factory initial programing procedure. I know these were used for 2 different displacement engines, so I doubt they batch-ordered the flash with an image already on it.

Anyways, off to get those photos.

EDIT:
Here's the photo's, decided to just upload them as attachments instead of linking/thumbnailing them.

Also noticed that there seem to be 2 flash memories, not sure what to make of that right now, as I don't see a crystal for a second processor.

[antus]

Hmm interesting. Not too similar to our flash pcms though - picture here (this is a pcm from 2001, and thanks to VL400):

VYPCM_SM.jpg (199.76 KiB) Viewed 7922 times

It'd be interesting to take a look at a bin - I would say they would share a lot code, but being ours flash over aldl, and you say yours is obd2 (do you know specifically which protocol?) there would be some work involved. Are you sure yours isnt ALDL? Does any flashing software support it?

[300d50]

The protocol is Class 2 J1850, 100% certain it's OBD-II since it is a legal requirement for cars sold from January 1st of model year 1996 in the US.

I'll get BIN's from both flash chips as soon as I get a spare PCM.

[300d50]

Sorry for the double-post, adding in the .bin files and some hex dumps made with xxd.

I ended up rubbing the sharpie-marker off that I used to mark the chips, so the _a and _b are arbitrary.

Verified both memories for multiple reads, but there may be corruption due to heating them in an uncontrolled manner. (I used a butane micro torch instead of the hot air station, no outlets in the junkyard...)

I'll try dumping it through the 68hc11 disassembler after I get done slapping some oil in the engine and seeing if it will do the fire-then-die for us to confirm it's not dead.

EDIT: added "decoded" .bins to the zip, along with their hex listings

[roughneck427]

I know caleditor is his handle on other forums is a big northstar guy and has worked on making tthem tunable here on his website says he can tune all years. I know him and westers garage are the only people that have been able to tune them. http://www.pcmcalibrators.net/supported-vehicles.html

[300d50]

Well, pulled my hair out for a while thinking I had fried the flash and got a corrupt bin read.
Turns out the bins were obfuscated the same way that the 99 Saturn pcm was.

Sabercatpuck's posts here and here helped immensely, and my own check on the PCM confirms his findings are valid for the 96 northstar PCM.

Since I didn't feel like writing a program to de-obfuscate the bins myself unless I had to (lazy or efficient, you pick... ), I searched and found that video games were again the solution!
Turns out the Nintendo hacking crowd needed to do the same thing, and someone by the name of Farid released a tool to do it, which you can get here.

I'll be editing my older post to update the zip with the "decoded" bins, and their hex listings.

[antus]

Nice find!

[300d50]

Not much to say, no real progress.

Contemplating just throwing an OBD1 pcm at it.

In a bit of a funk due to an extended layoff.