LLY Ficm

2004LB7

Well-known member
Dec 15, 2010
6,969
2,137
113
Norcal
Ok after an hour, it's still working. That's pretty good for me..

Tossed everything at it diagnostically I can do by hand with sub $100 tools, and can say fairly certain that it doesn't conform to J1939 protocol by any way besides it registers correctly on the bus at start up.

Doesn't seem to respond to basic requests for DM2 trouble codes, and doesn't broadcast any DM1 codes, yet setting here with every major circuit in an Open state. I even sent it basic engine / transmission protocol packets like RPM, Load, Temps, Pressure, Gear, and noting changed in it's streaming 2-line of data structures. Leaning towards that dumb box theory again.

However I did notice that PGN 65280 Byte 0 is always 0x80. And from sniffing other HS GMLAN packets, 0x80 in Byte 0 usually equals an Open Circuit or unhappy parameter if I recall. So might be catching on to the GM engineers Proprietary PGN structure.

The Second PGN 65281, has just one bit flashing on and off every 500ms like a heartbeat signal or something. That's as it has to say so far.

Any LB7 gurus left out there with winos dissected bin files, it would be helpful to know if anything relevant matches up to this simple data structure. I'm guessing it's simple diagnostics inputs for the ECM to use.

View attachment 117320
I have someone who might be able to get the actual file used by GM. So it would have every single table with their lables. He was showing me some of the ones he got for the VWs and Audis. Looked like there was hundreds of tables. And he was saying these where the small ones. Some he worked on had thousands of tables. We where looking at the DSG transmission tune for my Jetta. I'll have to check with him to see what other platforms he has access to. He is pretty good with WinOs. But I don't know if he is familiar enough with GM stuff
 

kidturbo

Piston Tester
Jul 21, 2010
2,537
1,366
113
Somewhere On The Ohio
www.marinemods.us
That would be very helpful.

I was wrong, these don't even register on the canbus correctly. It doesn't even announce it's registration onto the network. Just boots and sends data. Totally non-J1939 standard.

So I tried to break the FICM, and as suspected, that 0x80 was an open code on the Pin 94 crank signal wire. When I touched it to ground, it changed to 0x20 and stayed there until powered down. However no data changes if ya ground the injector controls.

So I did a quick test with volt meter and found, crank signal wire pin 94 reads 2.5v all the time. Some level of a pull up resistor on that line input. Also the injector control lines, all read 5v.

Hope that helps on the circuitry layout. Also I have a buddy there in central Cali who's pretty good with a J-Tag tool and reading bins. Might put you in touch, as would be nice to have a look at the running version on a couple FICMs.
 

2004LB7

Well-known member
Dec 15, 2010
6,969
2,137
113
Norcal
After seeing another FICM, it definitely wast that plug. Was right in the middle of the cover.
Well if you still have the chance to snag up just the FICM then maybe go for it. I would not be surprised if it was still clean and perfect inside
 

kidturbo

Piston Tester
Jul 21, 2010
2,537
1,366
113
Somewhere On The Ohio
www.marinemods.us
Next on the plans is to try feeding this LB7 FICM some crank wheel pulses, along with some random 5v pulses on a couple of those injector control lines. Hopefully we see how it responds on the injector command lines. Should tell is how dumb or technically in depth this box actually is. My Arduino emulator operates on 3.3v, and I don't have any SSR's handy to amp up the that crank signal, so be curious to see if it accepts a low voltage signal. But first question is, which tooth do ya knock off the reluctor wheel to make a LBZ run on LLY? Gottat setup the pulses on the emulator.

Could also use an APPS pedal out of a truck, along with the connector pigtail if anyone has some junk laying around. I don't recall right off if the LB7 and LLY used same APPS voltage curves as the LBZ/LMM, but I think it's different. That's all I'm missing to get ECM up and running on the bench next.
 
  • Like
Reactions: juddski88

2004LB7

Well-known member
Dec 15, 2010
6,969
2,137
113
Norcal
Next on the plans is to try feeding this LB7 FICM some crank wheel pulses, along with some random 5v pulses on a couple of those injector control lines. Hopefully we see how it responds on the injector command lines. Should tell is how dumb or technically in depth this box actually is. My Arduino emulator operates on 3.3v, and I don't have any SSR's handy to amp up the that crank signal, so be curious to see if it accepts a low voltage signal. But first question is, which tooth do ya knock off the reluctor wheel to make a LBZ run on LLY? Gottat setup the pulses on the emulator.

Could also use an APPS pedal out of a truck, along with the connector pigtail if anyone has some junk laying around. I don't recall right off if the LB7 and LLY used same APPS voltage curves as the LBZ/LMM, but I think it's different. That's all I'm missing to get ECM up and running on the bench next.
It's hard to tell from looking at the difference between the reluctors because the bolt pattern is not the same. I'd say for your purposes, it shouldn't matter. But if I had to guess I'd say the first tooth
 
  • Like
Reactions: kidturbo

darkness

Well-known member
Jul 15, 2009
1,315
379
83
48
vegas
It seems that whenever someone used an Lbz crank in an earlier engine it was always “take a tooth off.” Thinking it doesn’t matter.
 

1FastBrick

Well-known member
Dec 1, 2016
2,539
1,068
113
Junkyard
So you need one of these? I know the LB7/LLY is different from the LBZ/LMM. Just not sure what all is different.
 

kidturbo

Piston Tester
Jul 21, 2010
2,537
1,366
113
Somewhere On The Ohio
www.marinemods.us
So you need one of these? I know the LB7/LLY is different from the LBZ/LMM. Just not sure what all is different.
Yep that sure looks like the correct one. I have one from a Corvette that works great on LBZ/LMM, but recall those having a different slope curve, or min/max voltage.
Can always toss a couple pots on the signal lines and get it to fire at idle, but a pedal will let me run the full torque tables on the bench.
 

1FastBrick

Well-known member
Dec 1, 2016
2,539
1,068
113
Junkyard
I only have a spare LBZ pedal and harness... I didn't know the little LBZ harness was so valuable...


 

kidturbo

Piston Tester
Jul 21, 2010
2,537
1,366
113
Somewhere On The Ohio
www.marinemods.us
I only have a spare LBZ pedal and harness... I didn't know the little LBZ harness was so valuable...


SAY WHAT ???

I'm gonna go raid the local bone yards. Bet I an find a dozen in a day..
 
  • Like
Reactions: 1FastBrick

kidturbo

Piston Tester
Jul 21, 2010
2,537
1,366
113
Somewhere On The Ohio
www.marinemods.us
Ok so I spent half the night rewriting this Arduino code, and 30 minutes testing.

Learned a few useful things so far.
  1. The FICM will accept a 3.3v crank trigger signal.
  2. CANbus J1939 PGN 65280 data bytes are crank signal related.
  3. GM Engineers Wrote This Code...
When testing with FICM Pin 94 Crank Signal, these changed observed in PGN 65280 data.

Byte0 Data in Hex and Binary
  • 0x80 / 1000 0000 = Open Circuit
  • 0x40 / 0100 0000 = Shorted To Ground
  • 0x20 / 0010 0000 = Bad Signal / Glitching / Not Correct LB7/LLY Pattern.
  • 0x00 / 0000 0000 = Happy Camper & Byte1 Changed To 0xCC / 1100 1100
Reason I share that structure, same as I've seen commonly used on other GMLAN data. That first byte0, when viewed as bits, is just a single bit telling other nodes this data is Good or No Good. I was able to define those last two lines by switching between known crank signal patterns. When running the LB7/LLY wheel pattern, at any RPM up to about 20k, it read 0x00 0xCC. If I changed the pattern, it read 0x20 0xCC. And yes I tested a LBZ wheel, and it was also unhappy.

So by the examples below, Byte0 is the Signal Line Status, Byte1 tells it's Receiving Data. Also noted the second PGN 65281 Byte6 data added a couple bits, and changed faster when it has a good crank signal. So as thought, it's related to some heartbeat message. Hopefully that one yields something useful. But for now, we know it's at least reporting it's status back to the ECM ..

Here is my stimulated wheel build. I took the tooth off to the left of the gap. Best call I could find anywhere online.

Crank_Cam_Stim1.jpg

Good Crank Signal 750RPM

LB7-FICM-Good-Crank-Signal.jpg

Bad Crank Signal 750RPM
LB7-FICM-Bad-Crank-Signal.jpg
 
  • Like
Reactions: DAVe3283

TheBac

Why do I keep doing this?
Staff member
Apr 19, 2008
15,610
1,866
113
Mid Michigan
Reluctor wheel info:


I dont understand anything posted above. ^^ Way above my pay grade. :ROFLMAO:
 
  • Like
Reactions: kidturbo

kidturbo

Piston Tester
Jul 21, 2010
2,537
1,366
113
Somewhere On The Ohio
www.marinemods.us
Thanks for the link. The first pic above with scope captures, is from this little Arduino board project I found works great at spitting out whatever crank and cam wheel patterns that match many modern engines. The 58 tooth line is an LBZ, and other tagged LB7 is our 57 tooth, show by the wider gap in crank pulses. Relationship of that gap to the red line listed as Channel 1, which is our Cam wheel pulse. I know the LBZ/LMM version is good, that is one I run all my bench testing with. ECM diagnostics shows a perfect coralation and balance rate when checked with a scan tool. The LB7 line below, shows using same pulse timing from end of the big gap to first notch on the cam wheel. Which is what all the GM ECM's use to calculate TDC on Cyl 1, to get the engine firings. But as been noted in the real world, once known, the Duramax will run fine with the Cam sensor disconnected.

So while not important at this stage of testing, is important where that TDC mark and missing tooth line up to those injector control pulses down the line. For now the FICM seems a happy camper with any 57 tooth, or 60-3 pulse. But sent an unhappy 0x20 code when I tested a LBZ wheel against it. Tells me that box uses the signal for some calculation, and reports back to the ECM if it's receiving a crank signal it doesn't like. How important is that in the operation of the FICM, yet to be decided.

@2004LB7 do ya know anyone good with Arduino coding that could write us a script based off this crank/cam emulator code that would pulse the 8 injector control wires? Thinking we could create a fully simulated bench rig that runs a FICM with injector patterns we can control and tweak to explore a full range of possibilities. I know this little $15 board sure makes life simple in my LMM work..
 

2004LB7

Well-known member
Dec 15, 2010
6,969
2,137
113
Norcal
Thanks for the link. The first pic above with scope captures, is from this little Arduino board project I found works great at spitting out whatever crank and cam wheel patterns that match many modern engines. The 58 tooth line is an LBZ, and other tagged LB7 is our 57 tooth, show by the wider gap in crank pulses. Relationship of that gap to the red line listed as Channel 1, which is our Cam wheel pulse. I know the LBZ/LMM version is good, that is one I run all my bench testing with. ECM diagnostics shows a perfect coralation and balance rate when checked with a scan tool. The LB7 line below, shows using same pulse timing from end of the big gap to first notch on the cam wheel. Which is what all the GM ECM's use to calculate TDC on Cyl 1, to get the engine firings. But as been noted in the real world, once known, the Duramax will run fine with the Cam sensor disconnected.

So while not important at this stage of testing, is important where that TDC mark and missing tooth line up to those injector control pulses down the line. For now the FICM seems a happy camper with any 57 tooth, or 60-3 pulse. But sent an unhappy 0x20 code when I tested a LBZ wheel against it. Tells me that box uses the signal for some calculation, and reports back to the ECM if it's receiving a crank signal it doesn't like. How important is that in the operation of the FICM, yet to be decided.

@2004LB7 do ya know anyone good with Arduino coding that could write us a script based off this crank/cam emulator code that would pulse the 8 injector control wires? Thinking we could create a fully simulated bench rig that runs a FICM with injector patterns we can control and tweak to explore a full range of possibilities. I know this little $15 board sure makes life simple in my LMM work..
I was working with someone on another site a number of years ago for some code. But lost touch with him. So at this point I don't know anyone anymore.

But I do have a friend that has done some coding for other languages and may be able to pick it up being based on some other more common ones. I can check with him as it would definitely be more his thing then mine.

For that crank signal. Have you tried alternating the timing relationship on the crank and injector control to see it it knows or stays happy?
 

kidturbo

Piston Tester
Jul 21, 2010
2,537
1,366
113
Somewhere On The Ohio
www.marinemods.us
I was working with someone on another site a number of years ago for some code. But lost touch with him. So at this point I don't know anyone anymore.

But I do have a friend that has done some coding for other languages and may be able to pick it up being based on some other more common ones. I can check with him as it would definitely be more his thing then mine.

For that crank signal. Have you tried alternating the timing relationship on the crank and injector control to see it it knows or stays happy?
Actually just wrapped up some further testing using the emulator. As you suggest, I spoofed some of the Control wires with a Cam signal pulse just to see how they would respond. When I noticed a few weird points, that make me think we may be approaching this problem incorrectly.

From what I've noticed so far on this experiment, the design, programing, and even communications ussed by this FICM board, makes me think Isuzu robbed it from and existing engine... Possibly the EDC15C7 board, which popped up, and looks as very similar. I didn't look long, but suggest we google searching every # printed on these boards. And the processor chips.

Reason I think they used existing hardware, the basic pinout gives a clue. They use 2 pins spliced together in the harness to supply 1 injector Command. Did it Twice.. Why you might ask? Because they simply ran out of BIG wire terminals on the PCB design to use.

LB7-FICM-Splic.jpg

I saw this weird SPLICE listed in the pinout and wondered WTF. Then when I cut the harness open, I noticed they cobbled two [don't quote me on the wire sizes] 22ga wires together to feed a single 14ga wire commanding one injector. Why? And how is this routed on the board? Possibly getting hot? Sure would if ya sent 15amps at 48V down a single 22ga wire.. Some last minute workarounds were taking place in the old Isuzu lab...


20230903_021831.jpg

20230903_021939.jpg

Remember I stated the shielding on the Crank signal was definitely an after thought, which they likely caught in early production or testing. Well this is better than that. They obviously didn't have enough sockets on this board to power it, and fire 8 injectors.. 4 yes, 6 yes, but to do 8 properly would have required a totally new board and connectors. They robbed this unit from something out there, and we just need to find what Volvo, Audi, Isuzu, or MB part they hacked up, then reflash it. My quick 2cents for the hardware history of this 6.6L FICM. More to come.
 

kidturbo

Piston Tester
Jul 21, 2010
2,537
1,366
113
Somewhere On The Ohio
www.marinemods.us
When I fired up the emulator and gave the FICM a good crank signal, I then started attaching some of the Injector control wires to the CAM signal wire on the Arduino board. That pulse is emulating the LB7 cam wheel, and has some longer ON and OFF times compared to a crank signal. Sure enough, the second line of our CANbus data lit up.. The first "6" bytes seem to be status of the control wires.. Byte7 is some timer, and Byte8 remained 0x00. See below.. These bytes change depending on how many control wires I twisted together.

The fact they are sending 8 injector control line status back to the ECM using only 6 bytes of data, again tells me this box had another job long before being drafted to become the stand alone fuel injector control module for a V8.. Because they are monitoring those injectors control lines using a CPU, and likely that CPU had other duties before they hacked up some code to make it speak J1939, which is totally due to Allison..

LB7-FICM-Ctr-Spoof.jpg