Thanks to Ironduke, I was able to read full flash for a couple of E92, 2-byte. One is an OEM replacement straight out of the box.
I note there is (obviously) no VIN, mileage or programming date in the EEPROM area. I expected that.
There is no slave OS, or slave cal data anywhere in the EEPROM sections (0x10000 and 0x20000). On other files, I have seen several references to the slave os, and calibration part numbers in the EEPROM. But nothing in this OEM replacement. All the other segments of the flash are programmed. Guessing the dealer would reflash the whole thing with SPS according to the VIN. But how does the EEPROM get written with the slave data?
On that unit though, a cheap scan tool DOES show the part numbers loaded for both of these segments (12625016 and 12624281). Is it correct that these are both stored on the slave chip elsewhere in the ECM (not the main flash)? Scan tools must be able to read, at least the p/ns, directly from the slave controller, then?
Does a full SPS also flash the slave chip?
Thanks,
Todd
[Original Post edited based on my learning more about the flash memory locations]
Let's Talk E92 Flash,EEPROM and Slave
Let's Talk E92 Flash,EEPROM and Slave
Last edited by tpepmeie on Sun Feb 09, 2025 1:25 am, edited 1 time in total.
Re: Let's Talk E92 Flash,EEPROM and Slave
The slave OS/Calibrations are usually on a separate processor, which is the "slave" to the master CPU
The master and slave communicate via SPI (typically). Update routines can vary between ECUs, but sometimes a custom kernel is uploaded to the slave to allow updating it. Othertimes the slave does not require any custom code, and already has the code built into its boot code to allow being updated.
GMs SPS does flash the slave chips.
The master and slave communicate via SPI (typically). Update routines can vary between ECUs, but sometimes a custom kernel is uploaded to the slave to allow updating it. Othertimes the slave does not require any custom code, and already has the code built into its boot code to allow being updated.
GMs SPS does flash the slave chips.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726

Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726

Re: Let's Talk E92 Flash,EEPROM and Slave
I updated the original post, as I've learned more about the various memory addresses. Still not sure how/when the usual slave data gets stored to EEPROM on the E92 (or E38 for that matter).
Re: Let's Talk E92 Flash,EEPROM and Slave
The emulated eeprom does not get the slave OS/cals written to it.
The slave operating system and calibrations are written to the separate slave processor on the circuit board.
For example, an E38 has a MC9S12 slave processor, whereas the main processor is a MPC562.
The slave operating system and calibrations are written to the separate slave processor on the circuit board.
For example, an E38 has a MC9S12 slave processor, whereas the main processor is a MPC562.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726

Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726

Re: Let's Talk E92 Flash,EEPROM and Slave
Tazzi, you’re right. I didn’t mean to say the whole slave os and slave cal gets written. Rather, it looks like the part number identification for both definitely gets written to EEPROM areas. A few places too it looks like. I wonder what command causes that p/n write to happen?
Re: Let's Talk E92 Flash,EEPROM and Slave
Something as simple as a power cycle and reading/clearing DTCs (even though none were present), seems to have caused the EEPROM area to get written including the p/n identifier from the slave OS and cal, I discovered tonight. This is all on a bench, not in a vehicle.