P04 Disassembly

[zack4200]

any chance you've come across anything related to the tach output? pin 8 of the clear connector is used as the tach signal on some applications (Grand Prix, Aurora, and probably some others that), but I connected my tach there with a Monte Carlo OS and it doesn't do anything, so I'm assuming it's only enabled in the BINs that were used with a discrete tach signal rather than tach over Class2.

Worst case, I found out after some more research that there's a tach output on the ICM that I can use, but now I'm mostly curious what it would take to enable the discrete tach output on the other P04 OS's lol

[antus]

Just reading back and seeing the post from 2023 that not much was known about the spark and fuel delivery, this was submitted since then. Reposting the link here incase it hadn't been considered in this context. I'd expect it'd be mostly or entirely the same thing. viewtopic.php?p=131488#p131488

[AngelMarc]

It did mention the other patterns used by other V6 setups. Delco CIC might be in the coilpack, or both it and the ECU.

[AngelMarc]

any chance you've come across anything related to the tach output? pin 8 of the clear connector is used as the tach signal on some applications (Grand Prix, Aurora, and probably some others that), but I connected my tach there with a Monte Carlo OS and it doesn't do anything, so I'm assuming it's only enabled in the BINs that were used with a discrete tach signal rather than tach over Class2.

Worst case, I found out after some more research that there's a tach output on the ICM that I can use, but now I'm mostly curious what it would take to enable the discrete tach output on the other P04 OS's lol

There could be something like other ECUs and OSs, serial cluster or dicrete wired gauges. Sometimes there's a setting for that.

[ProfessWRX]

Been at this again finally. Having pcm issues so I can’t update the tune and my car won’t go into closed loop after my brother borrowed the car for 6 months so Im stalled but:

I seem to have enabled OEM lean open loop idle and lean open loop driving but I can’t be sure since I can’t get the car to fuel correctly or enter closed loop so lean cruise won’t enable to test my values in it.

I think my issue is the ccp event. It’s DUMPING fuel into the intake when activated. Unplugged the ccp to intake and fuel trims stabilized but still locked out of closed loop and cant check anything since Im stuck on OEM code/tune until I can get a second pcm.

I’ve never dig into ccp code so turning it off permanently or correctly will take time unless somebody has mapped it all out.

[ProfessWRX]

Using the 7603 as a compare bin Im finding a surprising amount of code similarities.

Also looking at the recovery subroutine. All it does is check 2 bytes at the end of the bin. So if rhe middle of the bin is rhe part missing it never goes into recovery. I want to try editing it to check the final segment and if it fails it goes to recovery. But if it passes I want it to jump to another part to check the other segments. I don’t know what space I’ve got for each segment but I’m hoping I can make it work to improve the p04 recovery as I’ve so far found it useless.

[antus]

Yep, its an evolution across generations. And yes that's all recovery check it. The idea is that is programming start to end, so when the end bytes go down write is complete. However with PCM Hammer we go the opposite way, end back to start, this is so if the system is unstable you find out before the boot sector is touched. Other apps erase whole chip then start writing from the boot sector which can brick more easily in those circumstances.

[ProfessWRX]

Rather than allow bricks to easily happen, I've edited this OEM check:

Code: Select all

ROM:0000171A     sA55A_Chip_FC_Check:                    ; CODE XREF: sRecovery_MainLoop+114p
ROM:0000171A                                             ; sRecovery_Check+2p
ROM:0000171A 000                 cmpi.w  #$A55A,(dChipCheck).l ; Compare Immediate
ROM:00001722 000                 seq     d0              ; Set According to TRUE if Equal (else to FALSE)
ROM:00001724 000                 neg.b   d0              ; Negate
ROM:00001726 000                 rts                     ; 4000
ROM:00001726     ; End of function sA55A_Chip_FC_Check

This this far more robust check:

Code: Select all

ROM:00004000     sub_4000:
ROM:00004000 000                 cmpi.w  #$A55A,(dChipCheck).l ; Compare Immediate
ROM:00004008 000                 bne.s   loc_405E        ; Branch if Not Equal
ROM:0000400A 000                 cmpi.w  #$233,(word_6FD28).l ; Compare Immediate
ROM:00004012 000                 bne.s   loc_405E        ; Branch if Not Equal
ROM:00004014 000                 cmpi.w  #$800,(loc_5FFFC+2).l ; Compare Immediate
ROM:0000401C 000                 bne.s   loc_405E        ; Branch if Not Equal
ROM:0000401E 000                 cmpi.w  #$C528,(off_4FFE4+2).l ; Compare Immediate
ROM:00004026 000                 bne.s   loc_405E        ; Branch if Not Equal
ROM:00004028 000                 cmpi.w  #$45F0,(loc_3FFFE).l ; Compare Immediate
ROM:00004030 000                 bne.s   loc_405E        ; Branch if Not Equal
ROM:00004032 000                 cmpi.w  #$A94A,(loc_2FFFA+4).l ; Compare Immediate
ROM:0000403A 000                 bne.s   loc_405E        ; Branch if Not Equal
ROM:0000403C 000                 cmpi.w  #$E24F,(loc_1FFFE).l ; Compare Immediate
ROM:00004044 000                 bne.s   loc_405E        ; Branch if Not Equal
ROM:00004046 000                 cmpi.w  #$23A2,(off_FFFC+2).l ; Compare Immediate
ROM:0000404E 000                 bne.s   loc_405E        ; Branch if Not Equal
ROM:00004050 000                 cmpi.w  #$FA,(word_795A).l ; '·' ; Compare Immediate
ROM:00004058 000                 bne.s   loc_405E        ; Branch if Not Equal
ROM:0000405A 000                 moveq   #1,d0           ; Move Quick
ROM:0000405C 000                 rts                     ; Return from Subroutine
ROM:0000405E     ; ---------------------------------------------------------------------------
ROM:0000405E
ROM:0000405E     loc_405E:                               ; CODE XREF: sub_4000+8j
ROM:0000405E                                             ; sub_4000+12j ...
ROM:0000405E 000                 clr.l   d0              ; Clear an Operand
ROM:00004060 000                 rts                     ; Return from Subroutine
ROM:00004060     ; End of function sub_4000

There are two calls for this subroutine, so if I replace the jump address from oem to 4000 it executes the robust check. This code is written into the 4000 block which has zero code or data in it so once written as long as the boot segment and this segment aren't corrupt it should allow recovery mode to enter with any segment not fully written to.

Any input from you guys smarter than me?

[kur4o]

really bad idea, no need for that much testing for bad flash, also 4000 is eeprom and can get overwritten[there is 2 blocks 4000-5fff,6000-7fff that can get swapped by its own from time to time.

The purpose should be fairly simple, check last bytes[it works with all OS], if good don`t trigger recovery loop. Some tests were done long time ago, and recovery even its there and pcm dumps some data on bus, it was impossible to actually communicate with it.
HOpe that is not final conclusion and it can work at the end. To simulate bad flash you can try to find the ground pin of memory chip, that is responsible for last segment of data.

Than you can enter recovery mode on demand and do some tests if pcm can be recovered that way.


Programming last segment first is also really bad idea, it needs for safety reason to be, erase last segment first, write last segment last.

[ProfessWRX]

I found what is supposedly the ground pin on p04, but that did not work for any of the PCMs I've got.
viewtopic.php?p=139475#p139475

If it had worked, I never would have wasted my time with this.