Background:
The only programs that I know of for tuning an OBD2 LT1 are TunerCat (aka the JET Performance Dynamic Spectrum Tuner) and LT1Edit. The thing that kills me about these programs is that they don't do datalogging and have an ancient feel compared to LS1 programs like EFILive.

Looks are obviously not a problem--people have been tuning high power cars with these programs for years. I just think it's dumb that there's not a newer, all-in-one solution that works with OBD2 LT1 cars.

My roommate (dyermullet on CZ28) is a tuning junkie on older GM ECMs from the pre-OBD1 days. He mentioned that enthusiasts have reverse-engineered almost the entire logic for those older systems, and commented assembler dumps of these ECMs are readily available online. Late-model PCMs are obviously more complicated by several orders of magnitude, and I haven't seen much about the actual logic of these cars.

Questions
As a computer science major I'm really interested in learning about how the PCM operates internally, and what functionality is implemented in hardware vs. software. Here are a few sample questions:

Is there any reading material on the OBD2 interface that doesn't require SAE membership?
Has anyone done any research into the actual logic code for the PCM?
When an LT1 PCM is flashed or dumped, does data come in a typical TEXT/DATA segment?

 

Good luck. The folks who reverse engineered this stuff ain't gonna give it away for free.

Hint: Google Freescan, follow all links.

 

What CPU is inside the OBD2 PCMs? I've heard from diy-efi.org that it's the Motorola 68332. Anyone know for sure?

I found a hex dump from a '96 auto LT1 car from Brent's site. If you use a program like Notepad++ to view it in hex mode you can definitely see where the 16 tables are.

Here's an example from the first table:

0000 8080 1412 7373 434f 7e1f 01fc 8080 01ff 8000 2a05 1c80 0000 ffff ff00 8080
1414 2324 4006 8080 0000 4245 9999 8080 0000 7e7e 22ce 8a8a 0000 0a0a 5454 8080
0005 1E23 6464 8080 c3d7 292e 6464 0000 fefe 3235 6464 0000 ffff 434a 6969 0000
0300 1213 7373 0000 3410 1e1e 7878 8080 c00d 1016 6E64 8080 80d9 181f 6969 8080
30e1 2023 6969 5252 0800 0a0a 5454 9393 0000 0a11 5a5a 8080 0000 431e 5a5a 0000
fd79 7676 5f5a 2d2d 0000 2324 6462 0000 5050 4245 6964 0000 64a0 7e7e 786e 0000
0000 0a0a 6969 0000 7878 1e23 6969 114f 3c3c 292e 0e0a 5d5d 0073 1b1d 0828 5d5d
2828 2f32 2028 5d5d 1e14 3a43 9880 5d5d c8be 0a0a 4040 575d 8c97 1212 0505 5657
b405 1e1e 8080 5c5c 758c 8080 7880 6262 023a 8080 a005 6868 05dc 8080 3c3c 6e6e
0190 8080 504a 7474 0292 8080 0403 7a7a 7c02 8080 1010 8080 ffff 8080 c866 8080
ffff 8080 1c40 8080 0032 8080 1111 8080 2844 8080 0c0c 8080 8008 0514 3434 8080
0014 0008 0000 3200 8232 b23c 0d00 0000 0f07 8080 3900 0000 a100 8080 3900 0f00
8830 285a 1a00 2828 0e0e 1e32 5049 2828 0e0e 0000 021e 4646 0007 0000 2222 ffff
0000 1919 2030 0000 0505 0f0f 0503 5a5a 6467 0000 0754 0000 1819 0000 4333 e6e6
0f10 0000 fcfc 8080 201c 0000 ff00 8080 362f 0000 eaea 8080 3737 0000 9c7e 8080
f6ff 1919 ec26 0000 010f 0f0f 5000 fefe 1416 0505 ffff 2828 0c0d 0505 aaaa fe2c


I might have the line breaks at the wrong spot but this looks like 16 rows x 16 columns or some varition of that. Spark / fuel table maybe?

 

In regards to your original post, the tunercat boxes now have some datalogging software availiable called MXScan, availiable through www.moates.net/mxscan. Mxscan is still in development and isnt exactly the "all-in_one" solution you get with hptuners/efilive, but its pretty close.

For me and my brother's '97s, I went with a combo of Tunercat for making pcm updates and EFILive (it works for the most part with ODBII LT1 pcms) for scanning/wideband logging.

I'm also a EE/CS guy and think it would be neat to get a commented copy of the source. There's stuff like that for the ODBI pcms floating around the internet, but i've never seen it for the ODBII pcms.

 

And about that table -- the data values look too big to be spark. You would expect to see byte values in the 0x00 - 0x28 range (0-40 decimal for spark advance).

For an airflow table (VE) they would be in the 0x00 - 0x64 range (0- 100 decimal VE values) so it doesnt look like that either.

 

Interesting... so what tables does the PCM have? Perhaps the values in here are expressed as multiples of some constant?

Also, I noticed that the values in the tables don't seem to "flow" in any particular direction. Could this mean anything? Am I possibly looking at a bad dump?

Thanks guys!

 

Well on the earlier pcms there were two parts to the dump. I believe one side was primarily the operating system, and one side was primarly a data storage area - ie all of the tables.

You may be looking at a chunk of code, and not data. you could try passing the hex through a disassembler for 68332 assembly and see if the results have any sort of structure to them.

As for the tables - you probably ought to find someone in your area with a tuner program and just click throught it. The JET DST tuner (aka tunercat odbii) has a demo that will let you check out an LS1 tune. That will at least give you an idea of what things are there - however note that the newer pcms have alot more functionality than the LT1s

 

The OBD2 LT1 PCMs have all the tables the OBD1 LT1 PCMs have, plus some. Furthermore, a lot of the data is the same between OBD2 and OBD1 in the tables. So, if you were able to determine what a spark map table looked like in a OBD1 PCM, you could search for the same pattern in the OBD2 PCM.

You can download the DST demo at http://www.jetchip.com/downloads/DST_Tuner_Setup.zip

You should also check out http://www.diy-efi.org/gmecm

As was mentioned, there are two "sides" (EVENT and TIME) to these PCMs. Each side has its own microcontroller and EEPROM and operates somewhat independently from the other side.

Based on my observation, when they switched from OBD1 to OBD2, they only changed one of the "sides" out (the TIME side). The OBD2 TIME side has a larger EEPROM (128KB).

 

Me too! Please let me know if anyone finds this anywhere.

Fred