Reading/ Reflashing 29F chips - electrical gurus?

[SappySE107]

I think it would be a fair statement to say that at least some of the OBD-I information that you built your buisness and knowledge base on came from the DIY community, no?

With that in mind, can you see how some people might be just a little irritated?

Hmm, about the same lines as I can speak english because others taught me how. I learned how to tune from reading what others had done...or I should say, I learned the ideas behind tuning. I learned how to tune from testing, retesting, starting over, etc. Months and over 100 tests to get my modded 3.1 to run really good. Years to get my skills to where they are today. Do you think I owe the DIY-EFI community for teaching me how to tune. I don't. They didn't crack any code for me. They taught me where to start. I would thank them, but they shunned me once I started offering my services to others that didnt want to invest what I had invested (time), and wanted something that worked. I have something no other company has. A quality OBD1 60V6 chip. No one gave that to me.

[chri0029]

Wow, this tread is going in an interesting direction. My point before was only was that yes, OBDII reprogramming is a niche market right now. And, yes, there are a few with privileged information making a lot of money right now. However, I am very familiar with the insides of automotive industry, and it is not very difficult to do what we're trying to do. But what we haven't quite found yet is the 1 piece of key information that allows us to do it. It is there, it will just take some time to find. But once more people hold the secret, prices will come down to a more realistic level (for me and a few people at least). Some people don't mind spending thousands of dollars on their vehicles (custom engine work), so $500 is a small price to pay for tuning. But $500 times many people has got to be a cash cow for a small secret. Eventually more will hold that secret and then OBD III will come out & the cycle will continue. But for now, this is a hobby for a few of us. I have a piece of the puzzle, Planet has another piece, Demented has a piece, and others may have the final piece. I'd rather help put the puzzle together and learn from it rather than pay once heavily plus a subscription for a puzzle already assembled.

[Superdave]

If you can get the chip out, i know for a fact that it can be read. It's in the library of my Topmax burner.


i think this is a step in the right direction, we just need someone who will disassemble the binary and write a .xdf for it. tunerpro FTW!

[SappySE107]

plus a subscription for a puzzle already assembled.

What does that mean?

[chri0029]

Hence my original statement that if $500 were it, I'd be making the purchase now. But basically it's like paying $500 plus a subscription - once I program my computer, I will probably want to reprogram more, then more which becomes a subscription to purchase basically more credits (from the same source of course). Yet the first GM OBDII hack will probably be basically the same pattern as the rest - once you find the right piece of the puzzle it should carry-over from vehicle to vehicle.

From what I read, it seems that the earlier version of the OBDII reprogramming software was VIN unlimited. Then it changes owners and all the sudden it's a price plus a subscription (VIN limited) ...

[SappySE107]

A subscription implies a recurring payment to keep using the setup. You are talking about increasing your abilities and paying to do so. At least I know what you meant.

[chri0029]

Okay, back to the original tread direction, ...

I took my PCM to some specialty electronic shops today to see if I could pay someone to solder in a DIP (or IC socket). I decided to do this since I began thinking of reliability issues if I did it myself. This is due to the very tiny terminals, plus the chip is soldered to the top of the board rather than through. What if one of the solder joints broke during a large bump in the road or something? Then my vehicle stalls and is dead until I get it towed or change the PCM in the middle of the road.

I only got to take it 1 place so far, and they cautioned against it since the chip is so close to other components. The DIP socket would have to be larger than the IC, so space might be an issue. They said I would have to find a DIP socket first, then take it back to them. Their solder services are $40/hr so that wouldn't be too costly.

They did like my idea of doing a JTAG by directly soldering wires to the adjacent solder points further on the board. Then the chip wouldn't have to be removed from the board. I will have to talk with my EE buddy to see if he has any JTAG experience with similar chips. If it's just a few wires, it shouldn't be a problem soldering into the board.

[dimented24x7]

If you can get the chip out, i know for a fact that it can be read. It's in the library of my Topmax burner.


i think this is a step in the right direction, we just need someone who will disassemble the binary and write a .xdf for it. tunerpro FTW!

Thats what I did with the vortec PCM (the hack itself is floating around on TGO's DIY-Prom board), but very few people still use the blackbox PCMs. The irony is that the 98/99 computers are very good from a performance persepective. Theyre based off of the older TBI/CPI PCMs with improvements like SFI and mass airflow.

It can be done even with only a dissassembled bin and some basic electronics knowledge and tools. However, its time consuming and it gets exponentially more difficult with each generation of PCM/VCM. I know that the first one I did, which was a TBI ECM, only took a month or so, and thats with no prior experience. The older ECMs are so much more primitive and simplistic compared to the newer stuff. To put it in perspective, for the 98 PCM, the engine alone requires 5 seperate XDFs for tuning. One for spark, fuel, idle, emmisions, and general system parameters, with some 600 total parameters defined between all the XDFs. There is a lot of stuff in these later computers.

[dimented24x7]

I only got to take it 1 place so far, and they cautioned against it since the chip is so close to other components. The DIP socket would have to be larger than the IC, so space might be an issue. They said I would have to find a DIP socket first, then take it back to them. Their solder services are $40/hr so that wouldn't be too costly.

They did like my idea of doing a JTAG by directly soldering wires to the adjacent solder points further on the board. Then the chip wouldn't have to be removed from the board. I will have to talk with my EE buddy to see if he has any JTAG experience with similar chips. If it's just a few wires, it shouldn't be a problem soldering into the board.

It can be done. You will need an SMD rework station with closed loop temperature control (generic chinese units can be found on ebay for not too much) and a good, fine point soldering iron. In the first part of this thread, I have some info on how to get teh chip out: http://www.thirdgen.org/techboard/di...-101-step.html A key thing to do is keep the adjacent components cool when you desolder the chip. Damp paper towels work well for this. GMs PCBs seem to be stable to about 250 deg C, so as long as you dont go crazy with the heat, you wont damage the board or delaminate the traces.

[pocket-rocket]

It can be done. You will need an SMD rework station with closed loop temperature control (generic chinese units can be found on ebay for not too much) and a good, fine point soldering iron. In the first part of this thread, I have some info on how to get teh chip out: http://www.thirdgen.org/techboard/di...-101-step.html A key thing to do is keep the adjacent components cool when you desolder the chip. Damp paper towels work well for this. GMs PCBs seem to be stable to about 250 deg C, so as long as you dont go crazy with the heat, you wont damage the board or delaminate the traces.

I'm actually looking at this sort of equipment to start fixing Xbox 360's with a more permanent fix. I'm looking at this machine here:

http://store.sra-solder.com/product.php?xProd=6267

Many of the Xbox repair people that post use foil for deflecting the heat to surrounding components. This is a good SMD video to watch:

http://www.youtube.com/watch?v=JB1InDsWCjQ

[chri0029]

Wow, thanks Demented for the link to the awesome write-up. I will have to go through it a few times to have it really sink in (so much info!). I already loaded a bin from this site before and think I found a decent xdf to start with. Then will come the fun of digging-in. But my first problem was actually getting the info from the chip (then starting small - simply adjusting the simple constants).

I was on the same page as pocket-rocket. I also saw U-tube videos of lots of people soldering/modifying X-box chips. They make it look too easy! But then I began to think of the reliability factor - the x-box doesn't see potholes which could break weak solder welds.

I talked with my CE/EE buddies last night, and we might be onto something. Check out the picture of my PCM & chip. We started reading the AMD chip literature & matching the reprogramming pins of my chip. What we realized was an interesting phenomenon - the exact pins needed for a reprogramming the chip are actually already exposed in the board as dabs of solder in 2 rows a few mm from the pins (see arrows of the rows in the pic). Maybe it's a PCM manufacturer debug or manufacturer's reprogram without removing the chip? I'll bet there is a manufacturer's fixture that fits over the chip that directly makes contact with the dabs of solder for this purpose. So, my next thought is to take an empty bread-board and cut or machine out a hole for the chip. Then precisely place contacts on the underside and wires through the top side of the board. When you want to reprogram, just simply place the jig over the chip and bingo - your pre-made jig contacts hit the mating PCM board contacts. No soldering needed! (unless you want to solder wires directly to the PCM board). I'll have to talk with my CE buddies and see if they can program something in C++ to directly JTAG the IC through this jig. The only problem is it may be difficult to find a computer (we all have laptops) with a serial or parallel port for easy JTAG. That's where the USB programmers already pre-assembled make life easy. This is all just a theory, but could be something worthwhile. My EE buddy is going to ask his professor that is well-rehearsed in everything IC for his thoughts.

[bszopi]

http://www.logicalsys.com/

Not sure if anything there would work for you or not..

[chri0029]

Thanks for the site. I was originally thinking of going this way until a few problems came up. First, my chip is surface mounted. Most of these adapters have thru-pins to be soldered through. Secondly, the soldering part scares me the more I think of it due to the solder reliability. Third, there is not a lot of real-estate around the chip for a larger adapter to be mounted.

I made a quick-and-dirty sketch (attached) of my idea above. I hope I didn't over-simplify the device. It might become more complicated as issues arise. The biggest positive attribute is it doesn't require any soldering or modification to the PCM at all. If you happen to interrupt the flash and the chip is junk, just buy a new PCM at a junk yard for around $30 range. Plus they even give you 30 days warranty so you could always swap PCMs if the chip goes null. This concept has a few potential assumptions or flaws: I need to check feasibility with an IC guru if this chip can be JTAG'd which therefore assumes just 100 ohm resistors are needed through a PC parallel port (and applicable software which is just a mod of what's out there already). Also, I assume the chip can actually be programmed in the unpowered PCM board (besides the applied Vss and Vil voltages) without other component resistances interfering. Finally, the AMD specs don't mention JTAG pins, just write/erase pins which make the PC interface potentially more complicated and gives more potential for the chip to HAVE to be removed. This doesn't mean it can't be JTAG'd, but just complicates the process. But again in my chip picture if you follow the wire leads in the board, there is an interesting pattern in the row I highlighted since the leads don't stop at the solder points (they continue on through to the next chip). Unless they go through to the underside of the board (which is difficult to identify), why else would they be there? I have to talk with some electronic or IC experts further.

[dimented24x7]

I know in the PCMs I have, just about all the address lines are available as soldered terminiation points for factory testing. My vortec PCM has three long rows of such pins that connect to most of the MPU and flash chip, so you should be able to make connections at those points as well, once you find them.

[dimented24x7]

Im not a hardware expert, but as for programming, the flash chip's write functions are activated by the WE/OE pin states, and the write protect pin. If the correct voltages are applied, the integrated controller will then accept write commands through the lower 8 bits of teh data bus, if I recall correctly. Bascially, the chip is programmed serially with command bytes and data bytes defining the address and data to be programmed (normally sent by the MCU). The chip also needs a steady bus frequency to operate, so if you want to do something like that, you will need to provide it with just about all the signals it would need to normally operate within the PCM.

Another thing to look into might be backround debugging mode, which is supported by the 683XX MCUs. There used to be info on diy-efi.org for doing this with the earlier vortec PCMs. I dont know if your MCU still supports BDM, but its worth looking into, and easier than what your currently trying to do.