Quote:

Any luck on the code yet. I need fuel tables and the desired idle table figured out before i can debug any further. Please let me know, as the desired idle hardware table is in the src i sent you.

Was racing on Wed and Thurs, went back to work today. This code is new to me so it will take more time.

-->Slow

This does help thank you. Im looking for a source of individual female male stock connectors though so that we can bundle the kit with whatever parts it will need for the swap. As for extending the wires to the passenger compartment, this will be a very needed thing considering the emulation hardware isnt waterproof and while we thought of using an internal pcm sealed device, it was discovered that the bluetooth comunication couldnt even penetrate the pcm much less the firewall easily.

Z24 FReQ (Jarett) wrote:I don't know if I can be of any help, but I do quite a lot of harness building/troubleshooting here at work. I had asked one of the engineering techs a few months back on GM connectors. I was considering a large project where i could relocate my pcm. it almost seems the best route is to create the harness using MIL-STD sub-D connectors (for being under the hood and inclement weather), and splicing it in. how many wires are we talking about here? 50+?

oh, almost forgot. here's the reply email the engineering tech sent me:

Quote:


Jarett,



I have a catalog that has the generic Weather-Pak connectors in it, but not specific connectors for a given GM application.



Those I get from the junk yard (with a pair of wire cutters).



The connectors I get are from:



https://www.delcity.net/



http://www.waytekwire.com/



Hope that helps…….Tim.

I will tell you, this guy does know his stuff. he's done plenty of newer engine swaps into sandrails. You might also want to check out:
http://www.newarkinone.com
this place won't have automotive-style connectors, but may help give you ideas on what's needed for a "relocation harness".

let me know what you find. I'm not switching to OBD-1 anytime soon, but I am interested in what you find.
I have built/repaired/troubleshot a lot of harnesses at work (some have 150+ connections), so if I can be of any help, let me know.


Desert Tuners

“When you come across a big kettle of crazy, it’s best not to stir it.”

An idea was presented to me today and i'm considering it. The engine bay side only needs a waterproof connection vs the rest of the harness. One buddy of mine asked why i couldn't just tap the current lines with some type of connector not unlike the kind used in pc's and hot glue it to seal it. That was an idea, but still i'm very weary doing anything halfass.

As for sacrificing a factory pcm, i found that the white/blue connectors are the same in the 95 as they are in the 96 ecm. Not sure if the pins are the same, but i will have an ecm comming over that i can butcher here soon. I was thinking that because i can get the 96 pcm's here for about 10 bucks, perhaps i will just butcher a few for connectors.

quite with the 2.2 ecm already...... get cracking on the 95 OBD 1 2.3 ecm

And only the 95 Auto 2.3's have the same ecm as the 96.




SPD RCR Z - '02 Z24 420whp
SLO GOAT - '04 GTO 305whp
W41 BOI - '78 Buick Opel Isuzu W41 Swap

SpeedRacer, the 95 2.2L ecm is the same ecm as the 2.3. When the 36 mask is figured out for the 95 2.2L, it will also be figured out for the 2.3L. Hence the 0D mask ecm decryption. If we retrofit a 16196395 to an 2.2L engine, it will only be a matter of updated tables and maps for the 2.3 tuning. See why I chose this route.

C Smyth wrote:As for sacrificing a factory pcm, i found that the white/blue connectors are the same in the 95 as they are in the 96 ecm. Not sure if the pins are the same, but i will have an ecm comming over that i can butcher here soon. I was thinking that because i can get the 96 pcm's here for about 10 bucks, perhaps i will just butcher a few for connectors.

Thats the part I was looking at....... the 96 has 3 plugs..... I know its been awhile, but I could have sworn that the 95 OBD-1 plugs where different then all 3 of the 96 OBD-2 plugs....... but like I said, its been awhile.

C Smyth wrote:SpeedRacer, the 95 2.2L ecm is the same ecm as the 2.3. When the 36 mask is figured out for the 95 2.2L, it will also be figured out for the 2.3L. Hence the 0D mask ecm decryption. If we retrofit a 16196395 to an 2.2L engine, it will only be a matter of updated tables and maps for the 2.3 tuning. See why I chose this route.

I think I'm following you........ but isnt it the eeproms you need to decipher, not the ECM itself? The 95 2.2 and 95 manual 2.3 both share the same ECM, its just different eeproms in them, how is retrofiting a different ECM going to solve the decripting a 95 Quad eeprom?




SPD RCR Z - '02 Z24 420whp
SLO GOAT - '04 GTO 305whp
W41 BOI - '78 Buick Opel Isuzu W41 Swap

I will grab our 96 ecu and double check. They could be the wrong plugs, but regardless I will be building a harness adapter for the 96+ car to the 95 ecm we pick for the project. I'm not sure if they're different plugs because the 95 was a wierd year, were if your car was built on a certain date it was odb2 ready, but may not have had an odb2 pcm in it.

SpeedRacerZ wrote:Thats the part I was looking at....... the 96 has 3 plugs..... I know its been awhile, but I could have sworn that the 95 OBD-1 plugs where different then all 3 of the 96 OBD-2 plugs....... but like I said, its been awhile.

Actulaly your close. The EEPROM mask software is a template that the actual eprom software is built on. the 2.2 and 2.3L share the same mask file. The only difference in them is the tables/maps so theoretically decoding the 2.2 mask 0D file for the 16196395 pcm should show the same results.

And in truth, all the decrypting of the 95 quad eprom has been done. I've layed out the tables and data, i don't know what the tables do yet but with the help of the 2.2L F1 mask i've been able to figure out about half of them. Here's how i get to the quad stuff.

Think of it like an AEM ecm, where its all programable, fuel, maps, timing. Now take the 16196395 ecm, that is fully programable, lots of support, the pcm has been commented fully. Now the issue comes that the pcm has to be able to run 4 injectors, a waste spark system and all the emissions garbage they throw on the ln2. Well, it just so happens that one has been set up to run an LN2 in a S10, meaning it runs the LN2. Not quite set up for the automatic yet, thats something that the tables would have to be worked out, but for the manual people it's a solution. This also means you can fit it to the quad4, reprogram the tables and your as good as set to go. I will actually release a few modified bins as quad 4 support grows, i will need a few beta testers who are willing to put some money into emulation hardware.

The 16196285 work is not dead yet though, rather as soon as I have the spec's on a proper workbench it will be going to testing. A workbench where i can plug up an ecm, and tinker with the tables till i identify them would work best. Anyone want to donate electronic parts, harnesses, etc... to the cause it would help greatly as there is short supply of 16196285 stuff in my region.

SpeedRacerZ wrote:I think I'm following you........ but isnt it the eeproms you need to decipher, not the ECM itself? The 95 2.2 and 95 manual 2.3 both share the same ECM, its just different eeproms in them, how is retrofiting a different ECM going to solve the decripting a 95 Quad eeprom?

makes sence to me now, thank you.

I can search around the local yards, might be a couple '95 2.2s out there (I know there used to be one, never thought to grab the PCM)

A plug and play harness for the '96 3 plug PCM to the '95 2 plug PCM would be great (OBD-2 to OBD-1 swap) as well as a '96 3 plug to '97/98 2 plug (for guys who want to swap to the HPT supported ECMs)

Just so I get the part numbers correct

16196285 = '95 2.2 and Manual 2.3 J-body ECM

16196395 = ECM out of?

Just so when I hit the yards, I can make sure I'm looking for the right ones.




SPD RCR Z - '02 Z24 420whp
SLO GOAT - '04 GTO 305whp
W41 BOI - '78 Buick Opel Isuzu W41 Swap

C Smyth wrote:As for sacrificing a factory pcm, i found that the white/blue connectors are the same in the 95 as they are in the 96 ecm. Not sure if the pins are the same, but i will have an ecm comming over that i can butcher here soon. I was thinking that because i can get the 96 pcm's here for about 10 bucks, perhaps i will just butcher a few for connectors.

The pins in the connectors are exactly the same. The connectors are not. They have different pin counts


sig not found

protomec wrote:The pins in the connectors are exactly the same. The connectors are not. They have different pin counts

Thanks for the input. Do you know the pin difference between the 16196395 vs the 16196285. I have one of these ECM's with complete wire connectors ecm side for $85, and the parts yard said to run extension wires you have to soldier wires in there?

Also, he said for $20 he'll cut me a harness set for the 16196285 so i can build a bench. I will be benching this unit so that we can decypher the rest of the ecm. I'm new to testbenches, so I'm relying on what the V8 guys have done, but to the best of my knowledge i mostly need a 555 timer to generate crank and cam pulses, led's to duplicate injector firing, a ICM to duplicate spark. Any other ideas.

I will let you know how the swap to the 16196395 goes, i'm probably going to have to snap some pics as it looks like the pcm is a sliver box, with 2 boxes connected to it, but no wires just hardware. My guess is airbag module and bcm.

UPDATE 5/26/06

Someone said that the 94MY ln2 uses a bank injection vs sequential on the 95 on up year. I'm not sure if the 16196395 is set up for sequential, but so far that is the only barrier i can see. Well that and a rewrite of the auto trans routines on the 0D for your auto guys.

Also, i've got some components headed here that will be used in the bench, when i get the test bench built, i will write up a schematic build list so that anyone else on this project wanting to test can build a bench.

I was thinking of using an actual scientific sensor setup to hook into a laptop to datalog my testing on the bench, though i was also told i can log via aldl. We figure that some of the science labs at the local college have electronic equipment that can generate pulses, and test inputs via a laptop.

Any ideas on how to build a good bench would be welcome.

what exact signals are you trying to reproduce? you might look into a function generator. how many signals at once are you going to need to generate?
as for looking at signals, you're definitely going to need an o'scope. I don't think the pulses going to/coming from the pcm are going to be that fast, or that small, so a regular 2-channel analog scope should be good for you. (I say analog, because a digital scope is going to cost you more, and 2 channel for comparison.) there is also a setup we use at work that is an o'scope program that you load on a Windows PC. IIRC, the probe connects to a USB port. I'm not sure how many "channels" the program can handle.
a decent multimeter, like a Fluke 77B/N would work. you'll probably need a decent solid-state 2-4 channel powersupply.
I would definitely look into a good jumper kit. those things have saved my butt at work a few times.

is that the kind of bench stuff you're talking about?


Desert Tuners

“When you come across a big kettle of crazy, it’s best not to stir it.”

Z24 FReQ (Jarett) wrote:what exact signals are you trying to reproduce? you might look into a function generator. how many signals at once are you going to need to generate?
as for looking at signals, you're definitely going to need an o'scope. I don't think the pulses going to/coming from the pcm are going to be that fast, or that small, so a regular 2-channel analog scope should be good for you. (I say analog, because a digital scope is going to cost you more, and 2 channel for comparison.) there is also a setup we use at work that is an o'scope program that you load on a Windows PC. IIRC, the probe connects to a USB port. I'm not sure how many "channels" the program can handle.
a decent multimeter, like a Fluke 77B/N would work. you'll probably need a decent solid-state 2-4 channel powersupply.
I would definitely look into a good jumper kit. those things have saved my butt at work a few times.

is that the kind of bench stuff you're talking about?

I've got some digi scopes, and a few analog ones, but to reproduce cam and crank timing i can use a simple 555 to generate the pulses. As far as sensor readings, i want to read the pcm output to a laptop log so that when i change something in the bin, i can measure it.

i've got several flukes also. As for power supply, i've got a yellowtop that is running to a alternator that is in turn powered by a electric motor. i'm trying to simulate the car's actual running conditions as close as possible. With resistor powered led's for injectors, and an actual icm hooked to spark plug wires, and a grounding block to simulate spark.

C Smyth wrote: As far as sensor readings, i want to read the pcm output to a laptop log so that when i change something in the bin, i can measure it.

I'd look into that PC-based scope then, or a digital scope. both should have the storage functions you're looking for. the digital scopes we have at work (I don't know the model number right off the top of my head) have a floppy disc drive that you can save snapshots of the screen with, including measurement setup.


Desert Tuners

“When you come across a big kettle of crazy, it’s best not to stir it.”

C Smyth wrote:UPDATE 5/26/06

Someone said that the 94MY ln2 uses a bank injection vs sequential on the 95 on up year. I'm not sure if the 16196395 is set up for sequential, but so far that is the only barrier i can see. Well that and a rewrite of the auto trans routines on the 0D for your auto guys.

Also, i've got some components headed here that will be used in the bench, when i get the test bench built, i will write up a schematic build list so that anyone else on this project wanting to test can build a bench.

I was thinking of using an actual scientific sensor setup to hook into a laptop to datalog my testing on the bench, though i was also told i can log via aldl. We figure that some of the science labs at the local college have electronic equipment that can generate pulses, and test inputs via a laptop.

Any ideas on how to build a good bench would be welcome.

The 16196285 PCM is not used, nor do I think its capable of doing, sequential injection. The obvious clue is that there is no Cam sensor input to sequence it. The less obvious way to know is to know the wiring.

Just to clarify, for 95, 2.2 man, 2.2 auto, 2.3 man used the same 16196285 PCM. 2.3 auot and all 96s used another PCM.

Do we know an application for the 16196395 PCM?


sig not found

No one has said (to my knowledge) that the auto trans code needs a rewrite. First, the trans control strategy for 4 speed automatics must be compared with what's in the code.

The 16196395 is a truck pcm. Look in pickups from 1995 and S10's from 1993 which use an electronically shifted transmission (auto trans with no cable connected to the throttle body). Tunercat sells $0D definition file which will work with many of the tables. It's used with smallblock v8 tbi, 4.3 vortec, and 2.2 pfi engines with auto and manual trans both part of the mix. No sequential is possible, but the engine really won't care.

Easiest way to generate correct pulses is with a pulse generator. I used a 120V pc fan driving a steel ring with 7 notches machined into it connected to a DIS module. A 2 channel handheld automotive grade scope as well as a cheapie older lab scope from Ebay will work fine to monitor signals to and from the pcm. LED's are also very valuable, as well as linear potentiometers to simulate various resistance based sensors. I've used a good quality pc power supply for the bench, but if you start driving injectors and/or coils you'll want something capable of delivering more current. The easiest way for me was a "boost pack." That allowed me to make a good connection with large wires right at the ecm.

A "good" bench and a working bench are not necessarily the same. I have a working bench currently connected to a 1227749. I am thinking about adapting it and getting the 95 OBDI J car unit. It's not "good" because it's large and has wires and connections all over the place.

-->Slow

protomec wrote:
The 16196285 PCM is not used, nor do I think its capable of doing, sequential injection. The obvious clue is that there is no Cam sensor input to sequence it. The less obvious way to know is to know the wiring.

Just to clarify, for 95, 2.2 man, 2.2 auto, 2.3 man used the same 16196285 PCM. 2.3 auot and all 96s used another PCM.

Do we know an application for the 16196395 PCM?

Ok so i didnt know there was no cam sensor, meaning the 16196395 definately will work as there is no cam code in the 0D.

The 2.3auto and 96's what did they use, straight odb2?

As for application, it was used on many vehicles, but specifically 93-95 chevy S10 LN2, same as our engine. I think the tranny routines for auto might even work without modification according to our recent tests at the junkyard and a ln2 with a auto fwd.

slowolej wrote:No one has said (to my knowledge) that the auto trans code needs a rewrite. First, the trans control strategy for 4 speed automatics must be compared with what's in the code.

The 16196395 is a truck pcm. Look in pickups from 1995 and S10's from 1993 which use an electronically shifted transmission (auto trans with no cable connected to the throttle body). Tunercat sells $0D definition file which will work with many of the tables. It's used with smallblock v8 tbi, 4.3 vortec, and 2.2 pfi engines with auto and manual trans both part of the mix. No sequential is possible, but the engine really won't care.

Easiest way to generate correct pulses is with a pulse generator. I used a 120V pc fan driving a steel ring with 7 notches machined into it connected to a DIS module. A 2 channel handheld automotive grade scope as well as a cheapie older lab scope from Ebay will work fine to monitor signals to and from the pcm. LED's are also very valuable, as well as linear potentiometers to simulate various resistance based sensors. I've used a good quality pc power supply for the bench, but if you start driving injectors and/or coils you'll want something capable of delivering more current. The easiest way for me was a "boost pack." That allowed me to make a good connection with large wires right at the ecm.

A "good" bench and a working bench are not necessarily the same. I have a working bench currently connected to a 1227749. I am thinking about adapting it and getting the 95 OBDI J car unit. It's not "good" because it's large and has wires and connections all over the place.

-->Slow

Ive read the easiest way to generate the pulses is have a 555 timer set up on a pot, it electrically generates the pulses.

As for the truck pcm, i've purchased on just for this project. If you can pick up one of the 16196285's at a pick a part or something and get them to provide a connector so you can plug it to your bench, that would be great.

I know your bench is bulky, but if you can decode the 6285, and i attack this on the 6395 we will be giving people 2 options. Which is better than one. As for tunercat, you can buy the 0D from them, or use our 0D for tuner pro RT which is fully supported.

Quote:

I know your bench is bulky, but if you can decode the 6285

Yep.. I'm workin on it. Wifey tells me I need to mow the hayfield that grew where our yard should be, so I need to put code away today.

If someone has a working 555 circuit, then great. 8 years ago no one had developed the 6 +1 pulse generator with variable frequency which I felt I needed, so I just simulated a spinning crank with mechanical means and fed the signal it generated to the OEM module. This was a much better method in the end. It allowed me to use an "advance type" timing light to actually view when the spark occurred in relation to crank position. Working out spark timing on a 2 channel O'scope can take a bit of time and isn't as dramatic or fun, imo

-->Slow

I like your bench that simulates closely an operational vehicle. Infact that may be the way my bench gets built. I'm looking for a interface for a laptop that simulates sensor outputs for the pcm, then reads them on another sense line live. Then i'm also going to look at the aldl stream at the same time as emulating via our hardware. The idea being, total control over the ecm function. I'm literally in the process of identifying double bytes, as they would be constants in the programming, as well as identifying single bytes. Then after all that mess is identified, i should know that the rest of the data is tables in the data area.

Then there's the code. The 16196285 code is semi-commented, meaning aldl locations are there, so it should be relatively easy to figure out what is what. Though, i have to backtrack it to find out where the aldl is stored in ram before it is updated to aldl, thats the issue right now. Identifying aldl info in ram. I think i can identify the aldl in ram, and then play with the newly found tables on the bench i can come up with something useful.

If you get time to start on this ecm before i do, that would be great. I'm still gathering parts for my bench so its going to be a while. I will lend you a hand any way i can, meaning if you need help with code or just testing something new, i've got a 95 ln2 with a pcm on it that we can hammer on till the rods fly. Also, talked with the parts yard today. he said we can hammer on the quad4 we got out there as well.

Quote:

If you get time to start on this ecm before i do, that would be great.

I've been working at it since the files showed up. I tole you it would take time. This code is set up with many, many functions buried in subroutines. While it makes it nice once the subs are id'd, it's a PITA in the beginning to follow program flow through any unknown routines. Added to that it doesn't use any of the same hardware locations as the older P4's, so there's no quick and easy way for me to pull out code sections by the hardware they access. A guy with experinece on later generation pcm's might have see some of this code as familiar, but I've got to do it by scratch. I've got to read the code, figure out exactly what the assembly instructions do, then back out and try to get an overview of the complex instruction set equivalent the assembly is duplicating, then make a bunch of notes and some reasonable guesses about what the code's supposed to be affecting, then move on to another code section. It's like putting together a 400,000 piece 3 dimensional jigsaw puzzle with a very vague idea of what the picture is. I've got 2 copies of the disassembly open at all times, a notepad file of semi permanent notes, a scratchpad that I write on, and a set of OEM service manals here.

I won't even think about asking you to try something in your car unless I'm 99% sure I know what the function is. That's what the ecm bench is for.

-->Slow

I agree with you, the code is a PITA, and i'm searching the net for someone with newer p6 experience, but so far this unpublished code is just that, nobody has a $36 mask or even close code.

I've walked the assembly for hours, just dumbfounded. Like i can find a sub that uses 3 different aldl readings to output something, but in all reality i know nothing about how it interacts. I admit my lack of knowledge, hence my request to you to try to help. And as far as what you have by your side, your closer than I am because i dont have oem service manuals, what i do have is 2 monitors, a notepad file, 2 copies of dissassembly open, the bmzx and bmzy open in a hex editor equipped for compairison, and i'm still stumped.

Lately i been trying to convert the code characters to simple english, you'll note it in some of the code you have. I may have gotten the translations wrong, but when i can read it like a paragraph telling me what its doing i get a better idea of what addresses are accessed and what for. I dont know if that works on your end, but maybe you could give me some tips as to how you figure out what the subs do.

A buddy of mine today asked me why we cant just figure out what the hardware addresses the pins hit are on, and just write our own code. I said, "Go a head, here's a spare ecu and all the files. Have fun."

Converting it to simple english is only half the battle. Then you need to make it into something relevant.

Here's an example. Look at the sub @ 0xE9A2. Here's the overall picture of what the instructions do. I've added some comments.

Called out @ 0x5B36, 0xA601   This routine is only called on 2x, meaning fairly specialized



Enters with Val in A		; The value in A depends on how the code progressed before hitting the subroutine

 A= ( A - d48 ) * 2		; The decimal 48, or hex value $30, might be a clue, sometime.

if A < 0, set A = 0		; Looks like we're limiting the table lookup

If A > d224, set A = d224	; Top end limit for table?

2D lookup, table @ 0x3677	; Need to ID table at 0x3677. Notes say coolant temp involved

set B = 1st lookup result

B = B * 16	; why the multiply by 16?

Save result in L014E	; If this variable is not accessed anywhere else, it's only a temp



Set A = RPM / 25	; 

2d lookup, table @ 0x3686	; RPM correction value?

Set B= 2nd lookup result 

B = B * 16

add L014E



If flags L009A, $#01or $#10 set, add val @ 0x3673	; flags could be for park/neutral... check this out

Limit result to $FFFF

Save result in L012F	; Can we determine what else accesses L012F?

end of subroutine



The only reason I'm looking at this sub is because it accesses a table which appears to be indexed by coolant temp.  Idle speed tables are usually indexed by coolant temp.  But I really know very little about what the routine is for, even though I have a good picture of what it does.

slowolej wrote:Converting it to simple english is only half the battle. Then you need to make it into something relevant.

Here's an example. Look at the sub @ 0xE9A2. Here's the overall picture of what the instructions do. I've added some comments.

Called out @ 0x5B36, 0xA601   This routine is only called on 2x, meaning fairly specialized



Enters with Val in A		; The value in A depends on how the code progressed before hitting the subroutine

 A= ( A - d48 ) * 2		; The decimal 48, or hex value $30, might be a clue, sometime.

if A < 0, set A = 0		; Looks like we're limiting the table lookup

If A > d224, set A = d224	; Top end limit for table?

2D lookup, table @ 0x3677	; Need to ID table at 0x3677. Notes say coolant temp involved

set B = 1st lookup result

B = B * 16	; why the multiply by 16?

Save result in L014E	; If this variable is not accessed anywhere else, it's only a temp



Set A = RPM / 25	; 

2d lookup, table @ 0x3686	; RPM correction value?

Set B= 2nd lookup result 

B = B * 16

add L014E



If flags L009A, $#01or $#10 set, add val @ 0x3673	; flags could be for park/neutral... check this out

Limit result to $FFFF

Save result in L012F	; Can we determine what else accesses L012F?

end of subroutine



The only reason I'm looking at this sub is because it accesses a table which appears to be indexed by coolant temp.  Idle speed tables are usually indexed by coolant temp.  But I really know very little about what the routine is for, even though I have a good picture of what it does.

Ok so i see how you reworded the hex into english. Do you have the original snipet address of this code. This actually helps me learn alot, because it crosses RPM and coolant temp. Sure we can find out what else accesses that location. Note it, and go on to the next sub.
My idea is that if i had a copy of the ENGLISH equivalant translations, i could with what we have get a general idea and narrow it down. What does L009A $#01`or $#10 set for, do you think P/N, that means what is the val at X3673, I know why it limits the result to xFFFF, a buffer overrun exists if the value goes over that.

Am i close? This could the idle table, because of correction vs temp.

Check out the table at 3686.

1.00
2.00
4.00
5.00
6.00
7.00
9.00
10.00
11.00
12.00
14.00
15.00
16.00
18.00
18.00
18.00
18.00

Does that look like idle correction values/temp? Or, do we process it as the code suggusts.

Something i can see offhand is that if you multiply these numbers by 16 you get.

16.00
32.00
64.00
80.00
96.00
112.00
144.00
160.00
176.00
192.00
224.00
240.00
256.00
288.00
288.00
288.00
288.00

So in reality, i guess i have no clue as to how this table really works, but i'm sure the answer is in the above math.

Question? What does a normal corrective table look like under 0D or other GM code. BTW i'm emailing you the tunerpro RT xdf file and ads i have so far so you can use it with your
test bench.

Chris

Message:

Quote:

This actually helps me learn alot, because it crosses RPM and coolant temp

It uses a table which someone else labelled as coolant temp. I've been burned by trusting someone
else's comments in the past.

Quote:

What does L009A $#01 or $#10 set for, do you think P/N

Hard to say. There is a park / neutral flag called out in the ALDL list, this isn't it.
Locating and determining the purpose of the flags is the toughest part of disassembly.

Quote:

I know why it limits the result to xFFFF, a buffer overrun exists

Not really. This isn't like Windows with virtual memory. There is no buffer here, just ram. In the case
of a value larger then $FFFF, the number is simply "rolled over," the carry bit is set in the condition code
register, and the additional significant digits are dropped. In other words there's nothing in hardware to
limit the value stored in ram. So let's pick a value such as RPM. If 6750 rpm were represented by $FFFF in hex, then
7000 rpm would cause the value to "roll over" and the engine rpm would be displayed as 0. The software limit
prevents this.

RPM is typically divided by 50, 25, or 12.5 in GM code. Once you find a likely
table you need to see where in the code its referenced, and work through to see if, in fact, it's related to the idle speed.

Tables typically look like little mountain ranges with one side of the mountain looking like a cliff and the other being sloped.
A table might be

255 240 230 210 180 106 100 255 238 222 200 186 100 95 Etc.

Use those numbers to find likely tables for idle speed. I'd expect the idle speed table to be a single slope of values, maybe with a plateau at one end as the engine temp climbs to normal.

Pattern recognition only goes so far.

-->Slow