This page documents my work analyzing and reverse engineering the GM 12588500 PCM firmware. I’ve collected notes, pinouts, variable mappings, function references, and other details that help me understand how this PCM works internally. Everything here is a work in progress, many of the names and assumptions are based on my best guesses so far, and I’m using this page as a reference point as I dig deeper into the code, hardware, and calibration structure.
- M68K is a 16 register CPU, each register being 32 bit
8 Data Registers (D0-D7) - General Purpose
8 Address Registers (A0-A7) - Pointers
A7 is always used for the system stack
All Big-Endian
- Runtime memory seems to start at 0xFFFF8000, no references to any values from 0xFFFF0000-FFFF7FFF
- Lots of empty memory between 0x50000-0x60000, insert custom functions there?
- Sensor inputs end up in runtime memory, need to map what address each sensor input ends up at
Sensor>Wire>Input pin>Analog to Digital Convertor (ADC)>Runtime Memory
Does not use a register to store sensor inputs, they go straight to runtime memory
- While each pin goes to the same ADC, they all have individual preprocessing from an input conditioning circuit
Cannot put a 0-5v sensor on a 0-1v pin, would clip at 1v and ruin all sensor data
Multiplexer (MUX) is essentially a fast, switchable input selector, it has control over what pin is exposed to the ADC
Likely going to have to increase the sample rate for the pin the wideband O2 will be spliced in at, maybe just flip the EGR and narrowband sample rates to accommodate?
- Could I VM this image, then be able to feed sensor inputs and see how it runs in real time?
A full pinout of the P04 PCM, covering connector numbers, pin numbers, wire colors, and what I’ve determined each pin does. There’s also a separate sheet where I’ve collected pins I wasn’t sure about yet. I’ve highlighted pins on the second sheet to indicate whether they can be used, might be usable, or definitely can’t be used. Basically my working reference for planning pin repurposing and figuring out signal mapping.
L36/L26 vs. L67/L32 Engine Platform Context:
The L36 and L26 are the naturally aspirated (NA) versions of the 3800 Series II and III engines, respectively while the L67 and L32 are the supercharged variants of the 3800 Series II and III engines, respectively.
Since my work focuses on the supercharged platform (L67/L32), many sensors and controls used in the NA platforms (L36/L26) do not exist in my application. That means these unused L36/L26-related PCM input and output pins are available for repurposing. Pins like AIR solenoid control and air pump relay control are specific to the emissions equipment on NA engines. On the supercharged platform, these pins are unused, providing a convenient interface for custom output functions.
(Personal note: Methanol Injection kit controlled by the PCM, running off one of the air pump outputs?)
This is my primary reference while working through the 12588500 OS. The sheet has two tabs: one listing all the tuning tables I’ve used and where they’re stored, and another that maps out runtime memory addresses I’ve been able to identify. This helps me keep track of where the PCM stores key values, and interpret what functions are doing based on the variables used.
A list of functions that I think I’ve figured out in the 12588500 PCM firmware — these are just my best guesses based on which variables they reference, not confirmed identifications. I used this more as a working list while digging into the code, but my primary reference is really the variables list.
The full Motorola M68000 Programmer’s Reference Manual. This is my go-to resource for understanding the CPU architecture the PCM is based on. It includes all the instructions, addressing modes, register details, and exception handling info. I refer to this constantly when disassembling the firmware and working out how individual instructions interact with memory and registers.