Reflash via the PC serial port

The 1996 and 1997 v6 PCMs have a "hardware test mode" that has various functions, including a P4-style Mode 5 and Mode 6 (download and execute) function. I took advantage of this function to allow reflashing the PCM via the serial interface. Basically, at initial key-on, there are TPS, ECT and IAT conditions and a Trans range input (or clutch for manual trans) setting that have to be met to cause the PCM to enter hardware test mode. Once it does that, it will stay in that mode for up to 5 seconds, waiting for input on the serial line. I modified my PCM using Steve Ravet's BDM reflash program to elimiate the ECT and IAT requirements (as well as increase the SCI baud rate), so that at initial key-on, when the clutch is released and the TPS is all the way to the floor, hardware test mode is entered and I can start reflashing. These conditions have to be met at initial key-on, or else hardware test mode will not be entered.

Although most v6 PCMs have SCI code in them, this hardware test mode was eliminated after 1997. With a little work most PCMs could be made to function this way. I believe the serial line is connected to the OBD-II underdash connector in most vehicles - consult the factory service manual.

The files named 16211539BSXN on the ftp site contain the .bin file for the PCM as well as a disassebly of that .bin. In addition, there is source code and executable for a CYGWIN command line program that can be used to reflash the entire PCM or a segment thereof.

The PCM checks for hardware test mode conditions starting at line 0xEB58. From there it does an SCI routine and enters an endless loop waiting for input from the SCI. This is used to load a "bootloader" into RAM. When loading is complete, the "bootloader" executes from RAM, erases and reprograms the flashROM. The PCM is then reset, and we're in business.

What you need to reflash via the serial port

The source code

The source has been released under the GNU GPL General Purpose License. This means it's distributable for free or for profit. If modifications are made and the resulting binaries are distributed, either freely or for profit, then the source modifications must also be provided for free. The intent is to encourage commercial users and developers to contribute their improvements back to the DIY community.

The .zip file with source code: serial_flash.zip

zipfile contents:

flash.asm               m68k assembly for the bootloader
flash.bin               the assembled bootloader
myserial.c              serial functions
pcmflash.c              the main program
pcmflash.h              the main program
program.c               for getting the identity of the flash device

Other Files:

16211539BSXN.bin        binary image of 1996 v6 PCM code
16211539BSXN.lst        disassembly of above code
Written by Darren Freed (darrenfreed@shaw.ca)