dimented24x7

iTrader: (2)

I think I figured out the sequence of events that takes place to do a reflash.The first step after establishing communications with the PCM is to gain security access. This is done by requesting the seed, and sending the correct key (or bypassing the security). Once you have security access, and the car is stationary and the engine off, you can request high speed VPW 4x mode, and either download the flash chip thru the port, or upload to the PCM. The mode $34 upload routine is actually where the control is passed off. Once the destination of the upload is verified, the routine performs a checksum on the boot sector and passes control to the boot sector, where the MCU goes through a soft reset. Once this is done, and the boot sector verified, the PCM signals its ready to accept the download. The downloaded code (which you have to write) is what actually does the reflash. There are still two lingering questions. The first is where and how does control pass from the boot sector to the uploaded routine. The second is what is actually needed to unlock the flash. The program voltage pin on the flash is actually tied to ground through a pull down resistor. During normal operation, the pin is pulled low to 0 volts. Somehow, +12 volts needs to be supplied to the pin, or the chip remains locked, and Im still not sure where that +12 volts actually comes from.

dimented24x7

iTrader: (2)

I found where the code gives control to the user. It basically waits for the user to execute teh block transfer routine. At the end, you send the address of where you want the PCM to execute next, and it jumps to any address specified.

But, Im still confused with whats actually needed to unlock the flash. I took a closer look at the board, and the trace coming off of the VPP ducks through a couple of vias and goes to bare mounting pads that looks to be for a small SMD transistor, but theres no transistor there. I verified that the flash does need +12 volts at the VPP to erase/program. W/o it, the chip is locked. Hmmm...

jwscab

pretty cool......I'd be willing to bet that the vpp voltage trace is on an internal layer somewhere, beyond what you see. You'd have to ring it out and see where it went.

I'd take a look, but I don't have the hardware in front of me. I'll usually put my digital voltmeter into diode mode, where it will beep, then just start touching pins/vias, etc until I hear a good solid beep. quickest way to find connecting traces....

not actually seeing the hardware, I'd guess that voltage is applied from a peripheral device, maybe a small 8 pin or low count IC that can drive the vpp voltage, controlled from the processor.(it is 12v for this device, or 5?)

HaulnA$$

Hay Adam, I have dabbled a little with the OBDII code some but you know me, the embedded stuff is cool but hardware is my thing. Anyway, I have been messing with OBDII since TC came out with it. I was one of the first ones to get his OBDII Tuner. When I found out how to download a full binary file (my '03 flex-fuel Tahoe), I got a copy of the free version of IDA-Pro and went at it. It didn't take me long to figure out that there was too much code to even attempt a full hack. Heck, the diagnostic stuff alone is overwhelming so I gave up. The main reason I gave up was, as mentioned, the later PCM's have code that is light years ahead of what we have ever seen. It is true, you can install a huge cam, turbo or SC or even a dry shot, change the injector flow table for bigger injectors and after a little learning from the PCM, have a great running engine. Real tuning only makes it that much better.

Anyway, to make a long story short, a while back, I cracked open my interface and started playing. I came across some numbers and after searching, I found the company that makes the TunerCat hardware, at least the early version I have. This is the same hardware that interfaces to the Roadrunner. The company is Advanced Vehicle Technologies http://www.avt-hq.com/ . I have the AVT-838 but it is no longer made. Check out the AVT-841 or the AVT-842. Both support multiple protocols including CAN and J1850. One is RS-232 and one is USB. I am willing to help in any way I can. I have a lot of experience tuning OBDII and I have a couple of spare PCM's including an '0411 and a variant from an '01 Supercharged 3.8 Regal. Let me know. Also let me know what you think about the hardware. I will post back later with some ideas I have.

Fast355

iTrader: (2)

Tom knows his stuff when it comes to OBDII. I met up with him this past Sunday. I found out just how many more tables are in the Tunercat program alone while we re-programmed a black box and 0411. With how well my inferior black box runs my stock express, I can not wait to get the L98 Vortec TPI running on the 0411. I know it will be a beast with great driveability.

super_kev

iTrader: (4)

I'll stand here and be the cheerleader. An open-source program (especially one that would interface with LSx engines) would be awesome, and I'd love to help out. But I have a lot to read up on before I can even come close to coming up with anything useful ('0411 PCM... what's that? ).

Six_Shooter

iTrader: (2)

I've started looking at the OBDII tuning, since well, the OBDI ECMs are getting dated, even though a lot of cool things can be done with them.

Anyway, I only have literally a few hours into reading about OBDII tuning (besides all those amazing fandangled products/tuner advertised in the magazines). I've come accross some info on downloading the bin, although it seems to be refered to as a "flash" when refernced in the OBDII documents I have read. The couple of items I have seen involved cracking open the PCM and adding hardware to to allow communication with the flash chip. There there was external boards needed to interface to the Laptop.

The other concern, if you want to call it that is that to upload a new bin to the OBDII PCM through the ALDL protocal the vehicle needs to be off, or at least the engine not running.

It seems that Moates/EFILive get around this by interfacing directly with the hardware of the PCM with an added daughter board. I can't tell if it replaces the existing flash chip, or works with it. The Road Runner does allow for real time tuning though, and would think that in the end this would be the best way to tune.

Now I guess you could use a modified ECM for real time tuning and then use a standard not modified ECM to upload the final bin to and leave in the vehicle. This would be a lot like using an emulator (Ostrich for example) to tune the good bin, and then burn to an EEPROM for the OBDI GM ECMs.

So I guess this project could actually take two directions from here, once hacked, one to tuning in a flash through the ALDL port mode and one to tune in real time.

Some questions on tables/constants/flags:

Is the PASLOK able to be disabled, like the VATS is in $8D (I would imagine so).
What about manual tranny tables? There is a particular engine that hasn't been offered with a manual tranny and many swappers that use these engines in earlier vehciles retain the OBDI ECM and most use manual trannies. I know some, like myself would like to use the newer SFI PCM, but with a manual tranny.

I know you (dimented) have only been working with one PCM and flash file, but do you suspect that the code could be used by other PCMs, similar to the use of $58 or $59 in a 7730 or 7749 or a 7727 or XXXX?
The reason for the last question is for similar applications like the need to use $58/$59 in other applications, like many people with 3rd gens with V8s and forced induction.
Someone using an OBDII PCM and boost would likely want to start with a flash file that started life as a boost refernced application.

I'd offer hands on help, but I'm still learning as much as I can about the OBDI ECMs right now. I will be keeping my eye on this though.
It also looks like you have offeres of help from people with the hardware that could be of more help than what I have currently.

I do plan to add OBDII ECM connectors to my test bench in the future though.

69 Ghost

iTrader: (1)

It seems that the finding of the hardware company that supplies the interface cable is a huge step forward. It would be really interesting if one of the CAN cables worked with Winflash. The way TC works is there are 2 separate programs that he supplies. Winflash is a separate program to flash the program. With that being said the bins should be able to be reverse engineered at that point. Am I missing something?

scuzz

This thread might have some insight into flashing PCM.
http://www.monodax.com/forums/tunerc...fried-ecm.html

Six_Shooter

iTrader: (2)

I was reminded today why I haven't been that diligent in persuing OBDII tuning when I went out to my 1998 Malibu and attempted to start it, it will turn over for excessive amounts of time, not run right even after it starts or stalls, and I've heard this complaint from MANY people that own and/or modify OBDII cars.

I'm sure there's some reason for this, but it seems to be a common problem with OBDII cars that I've come across.

My OBDI GM ECM equipped 1973 Datsun starts within the first reveloutions everytime and predictably.

18436572

Are you far enough along in the code to know if the sequ. fire pcm reverts to batch fire @ WOT.

Craig Moates

http://www.diy-efi.org/twiki/bin/vie.../VirtualComVPW

dimented24x7

iTrader: (2)

Wow... Been a while since I posted in this thread. Have to read the new posts and digest them.

Anyway. The new engine is on the stand and heading for completion, so Im trying to get the last of the essentials wrapped up. Currently, Im working through the idle routines. Much to my surprise (and relief), the idle algorithm is essentially identical to the $0D, so Ive been able to just use the $0D to comment the 98 stuff. The really nice part is that I'll be able to recycle all of my idle PID tables from the $0D and have 90% of my idle tuning done ahead of time.

I've decided to just cut a hole in the cover and socket the PCM and use my PP-II to tune. I have all the info needed on the OBD-II side to write software to scan and flash, but I dont have the time (or the knowhow) to write the PC software to do it.

Now that the PCM is almost done, I get to start the fun part of the build. Right now the car is basically just a unibody frame with a windshild and two doors. A year ago, I stripped it down to fix some collision damage, and devised a labeling system for all the parts and fasteners, which I promptly forgot. Now its sort of like putting together a big, greasy puzzle with 10,000 pieces.

If you want a sneak peak of the hack, Ive attached it. The engine code is not done yet (no comments on the EGR or O2 PID), but its getting there. There is also no e-trans code commented as Im running a stick. You will need to use the trial version of winzip 12 as the standard windows compression could not compress the .asm down far enough.

dimented24x7

iTrader: (2)

I dont think it does. The PCM runs at a high clock speed and can register up to 7000 RPM in the crank pulse interrupt routines, so it should stay in SFI under normal operating conditions.

dimented24x7

iTrader: (2)

The biggest issue with the black box is the hardware. GM has a lot of legacy in their systems, so the software probably didnt change drastically with the '411. The hardware, however, is much more streamlined with the '411. Everything is neatly placed on one board with nice, heat sunk injector driver transistors. The black box has those little weenie transistors and an eclectic mix of chips haphazardly placed on the split PCBs.

dimented24x7

iTrader: (2)

See my hack. I actually commented all the code for the OBD physical communications. The PCM does not have the code to reflash (this must be uploaded by you), but it can send the entire bin thru the port once you get security access. The OBD code is actually fairly straight forward, and is one of the easier things to comment as the various modes of operation are readily available on the net, so there are fewer unknowns.

As for the software being able to run on earlier machines, its not really possible. Each series of PCMs has its own unique hardware map. Unlike a PC that must conform to standards, the engineers map things to where ever they feel like it, and this changes with each series of PCMs. Also, the 68332 uses a different and more complex instruction set with only limited legacy. Even the basic commands like BRAnch are different due to the 32 bit architecture. This gives rise to short, word, and long formats many of the commands, as well as extention words for extended addressing.

As far as the manual trans stuff, its basically just a bit that you have to flip. This tells the PCM that an auto is not present. It then sets the in drive flag to '1' and skips all the e-trans code. On the engine side, the tuning is then just setting the in drive idle speed/open loop/closed loop idle %airflow PID tables for stopped and rolling idle to what works best for the engine.

dimented24x7

iTrader: (2)

Tom, I can definitely relate. I remember how overwhelmed I felt when I first started. I always hate that first step as its the hardest part trying to figure out where to start pulling at the knot. Even at the stage Im at now, only 1/3 of the code is commented.

dimented24x7

iTrader: (2)

Actually, I misunderstood this question, and was going to edit my reply the last time I posted here, but it seems that the boards now remove the ability to edit posts after a short time.

What I wanted to say earlier after re-reading your post, is that each series of PCMs can run code similar to what is done with the 58/59, but in a slightly more limited fashion. While code for a '411 PCM would not run on my earlier 98/99 PCM, or a later PCM such as a CAN compliant one, any code written using a mask specific to the '411 vortec PCM could be uploaded and run on any other similar PCM using that hardware. The same holds true for my 98/99 PCM. If I where to write a custom mask for it, any similar 98/99 PCM could run that code. It could be possible to run any GM code written for a 68332 processor on any PCM using that processor, but you would need to do a register and memory re-map as the MPUs used in these PCMs are made custom for GM and change every few years.

If you where to do something similar to the $58/$59 code, the '411 would likely be the best canidate for this. The code is fairly complete in these already, so the only mods you would likely need to make is a SD system that can utilize a 2 or 3 bar MAP sensor and possibly have waste gate control. Even though the A/D converters in these are still 8-bit, the value used for the MAP kPa is a 16 bit word (kPa x 205), so even in stock form, the PCM can read up to 320 kPa (or +3 bar absolute). In theory, it would be relatively straight forward to mod one of these for boost. The major changes needed would likely be to add larger or extended VE and SA tables (they currently only go to 105 kPa) and maybe do away with the MAF portion of the fueling.

69 Ghost

iTrader: (1)

I'm not sure this comment is entirely correct. On the tuner boards there are a number of guys reflashing their computers to newer bins. Some are repinning to newer ecu's depending on what they have but the 99 ecus on the 4th gens are being reflashed to the 411 tune. The general consensus on the 98 ecu is that it will not work because there are differences with some of the communication ports. The 99+ uses a uart and 98 uses serial. It is my understanding that has mainly to do with some of the stuff like the gas gauge, etc. In some of these cases HP Tuners guys will use the 411 tune for the motor but insert the older stuff to make their gauges work. I am not sure on how all this works but guys are doing it.

Six_Shooter

iTrader: (2)

I could tell from your first reply to my quandry that you didn't understand what I was trying to ask, and couldn't really think of another way to word it, at least not without writing a novel.

With this reply it seems that what I'm used to with the OBD1 ECMs, and switching programs between different ECMs to gain positive intake pressure variables and boost control, may not be needed. The way you put it, it almost sounds like the code may already be there or most of it, it just needs to be enabled. That would be pretty nice if that is how this ends up.

dimented24x7

iTrader: (2)

Sorry for not elaborating more... My comments where in regards to the 'black box' PCM that Im working with. Its much different than what was used in the LS1's, so they could not easily share masks. The biggest differences are the updated VPW datalink controller and 144 pin updated MPU. As for mask sharing, the most universal PCM was the one used on the LS1's and later vortecs. Those can likely share masks without too much difficulty. I suspect thats whats being done by HP tuners. However, there are limits as to what can be loaded onto what PCM for a given year. As for, say, a 4 cyl car using a V8 mask, that probably wouldnt be possible. I know from the code that at least some of the PCMs will actually halt and shut down if it sees other than 6 or 8 cyls. entered in for the cylinder count. This is likely due to the differences in the embedded TPU code that controls the hardware and sequential injector firings in the PCM.

dimented24x7

iTrader: (2)

Got around to socketing the PCM. I decided to use an externally mounted spring loaded ZIF socket. Press down on the outer frame, and the chip easily goes in and comes out. Im going to mount it on teh outside of the case for easy access. Real PITA to solder it, though. had to use 44 little 30 AWG wires to hook it up, along with a lot of patience.

The PCM seems to work with it and doesnt bomb out or throw a bad checksum. Hard to say how it will actually work as I can only run it for a few minutes before the voltage regulator overheats (thing with the paper towel on it).

I found that the commercially available 29F400 chips actually dont have the annoying +12 volt write protect on them (never could find the source to unlock the chip). If they work, then I can just replace them and open teh possibility to being able to flash teh PCM. The code on the PCM side is (relatively) easy, but I dont know how to do much with C++, so I have to hit the books and figure out how to write an easy interface to transfer a bin from the PC to the PCM. Really, all it comes down to is erasing a block or two in teh calibration section and re-writing that with updated calibration data. Most of the routines needed are already given in the PCM within the kernal's OBD-II interface.

Six_Shooter

iTrader: (2)

Sweet.

So the part that you're trying to figure out, as in how to send a bin to the PCM, would be like checksun disable in the OBD1 ECMs, or are you talking about through the ALDL port?

Socketing would allow the use of an emulator, correct?

dimented24x7

iTrader: (2)

The main thing about socketing is that I can use TunerPro and my PP-II to program the computer, so I wont be restricted by the limited number of items typically defined within the commercial tuning packages. The downside is that its time consuming and inconvenient to use the pocket programmer to tune. That, and any static discharge to the chip or the exposed socket would be instantly fatal to the PCM.

It may be possible to adapt the roadrunner system to the black box PCM and use TunerCATS OBD-II RT tuner and VDF editor to allow me to make a full featured definition file, but the overall cost is too prohibitive. Its a shame that they sold the base OBD-II tuner to Junk Performance. I loved the original TC and it would have been nice to have a user configurable tuning package that could simply reflash the PCM. Ive requested the same feature for HPTuners, but it seems to have fallen on deaf ears.

What I would ultimatly like to do is to make a simple PC utility to automatically handle the uploading of a memory resident program to the PCM that would allow me to export either a whole bin or just a calibration sector from TunerPro to the PCM. This would allow me to use TunerPro to edit the bin, and then just upload the new section to the PCM. This would allow the use of a standard PCM without having to have any extra appendages hanging off of it, but I dont have enough knowhow on the PC side of things to do it.

N0DIH

Sounds like you are asking for a BDM or JTAG interface.

Background Debug Mode.... This puts you on the "other side" so you can sniff anything that is going on.

69 Ghost

iTrader: (1)

TC uses a separate program called winflash. I would think that these guys actually provide the program to flash the pcm. Has anybody investigated this

N0DIH

TC said the AVT-841 and 842 ~should~ work fine with Winflash....

JTAG and BDM are background debug devices, they aren't like front end programs like WinFlash and the like. So using a BDM or JTAG, you are on the bus on a designed in background debug port. All PCM's ~should~ have them, the key is finding them. In my industry we remove the connectors and some other supporting parts to make it difficult to revive it. But it is there. It IS possible they have a different board spin for the production boards, which would make it more difficult, if not impossible.

http://www.faqs.org/docs/ldev/0130091154_272.htm





You can something like a Wiggler or other JTAG or BDM interface to connect up to the PCM's processor.

dimented24x7

iTrader: (2)

The PCM can actually be interfaced with directly thru the OBD-II serial port in high speed VPW (44 khz).

From the code, it works like this:
First you send a request for security access. The PCM will then send you a seed from an onboard EEPROM. You then send the associated key. If the key is correct, the PCM then grants you secure access.

After this, you can enable 4x high speed VPW which allows for faster communications. You then request to upload data to the PCM. The PCM checks to make sure that you have presented a valid key, that the car is stationary, and that the engine is off. If these qualifications are met, the PCM then jumps from the main code back to the boot kernal. From here, you can request to upload your own code, which you then transmit to the desired address within the PCMs RAM. After this, you send the desired address from which program execution will continue. This is specified by you, and can be anywhere within the valid address space. Once this is done, the PCM will jump to your address and continue from there.

The code that you upload to RAM actually does all the work. It would recieve the data and reflash the ROM. This can either use many of the existing OBD-II routines and standards, or work in some other fashion.

We just have to find a relatively simple way to make an interface, and more importantly, write software to communicate with the PCM.

N0DIH

Will the code that you put in RAM flash the flash chip once the PCM is powered down?

http://www.canopenmagic.com/

dimented24x7

iTrader: (2)

The PCM remains on the whole time during the reflash. Basically the code acts as an interface for the flash chip. It would take the data frames recieved from the PC thru the OBD-II port and translate them into the approproate commands and data for the flash chip. Within the flash chip there is a microprocessor that handles the actual reflash of the memory array, so the PCM needs to pass the command bytes and data to it. Along with this you would also want to have some bounds on what addresses can be written to (such as only allowing the calibration section to be erased and reprogrammed). Also would be a good idea to use checksums as is done in the OBD-II routines to be sure teh data isn't currupted during the transfer. In the case of a curruption, the software within the RAM could simply erase the section and start again.

Im not sure if standard CAN controller software could be made to work. Even though the later OBD computers are CAN, SAE dictates how the message frames should be structured. If you dont mind paying through the nose, you can purchase one or all of the OBD-II standards from SAE. IIRC, they where like $50-$75 dollars a section. They're fairly general, but they do give you a good idea of how things work.

CalEditor

Read this for some BDM info.
http://www.omnituner.com/Default.asp...5&g=posts&t=58

This is some BDM Hardware
http://www.pemicro.com/products/prod...TOKEN=36392617

http://shop.cmdelectronics.com/index...iewCat&catId=5

http://arlabs.com/

at the bottom of the page
http://autodiagnosztika.shp.hu/hpc/w...ILLESZTŐK


You should be able to find something on this site. The Forum is blocked to non members.
http://www.checksumm.com/


Now for Non BDM info.
Is that a A28F400BX?
A28F400BX-T[1].pdf

I will get you some "read" info on this.

dimented24x7

iTrader: (2)

The chip that originally came with the PCM was a 28F400BX-B. The boot kernal is in the lowermost part of teh address space, followed by the engine/transmission calibration section, followed by the main code.

BDM was used early on by Steve and others at diy-efi. org. That was how this started way back in 98 when these came out (wow... almost 11 years now). It requires some mods to the PCM, which isnt that big of a deal, but it would be nice to make something universal that can work on a stock, unmodified PCM. I have the routines that handle the OBD physical communications mapped out and commented, but still have to find a way to make it work on the PC side. Right now, Im thinking of maybe just a simple DOS program that can both read the calibration section, and re-write it using a specified file and address range via the OBD-II serial. Even at teh base VPW speed of 10.4 khz, the engine calibration section could probably be re-written in about 2 minutes as its not real large.

CalEditor

you will need to unzip the bin files in 7 zip
97 305 Man.zip
97 305 auto.zip

CalEditor

You will need to unzip the bin files in 7 zip
97 454 Man.zip
98 454 man.zip

CalEditor

You will need to unzip the bin files in 7 zip
98 4.3 auto.zip

CalEditor

You will need to unzip the bin files in 7 zip
98 350 auto.zip

98 350 auto 2.zip

98 350 auto 3.zip

dimented24x7

iTrader: (2)

Awsome! Thanks for the bins.

Sort of unrelated, but do you know offhand if any of those had the auxilliary electric cool fan? Thats one thing I have not been able to locate in my calibration. The OBD diag. routine is there, but they stripped all the rest of the code out of my calibration for it, so I cant find the Hardware I/O byte that controls it.

dimented24x7

iTrader: (2)

Did those actually come right from GM for VCM updates?

Edit: It looks like they may also be encrypted or formatted for use with a GM Tech-2

scuzz

On the trucks, I don't think they had electric fan stuff. I might be wrong though. I know that my 0411 Express has control though. I think the f and y cars had control in late 90's pcm.
I just opened TCII and looked at 97 truck cal and couldn't find fan tables, but attached is fan tables for 0411 Express van.
For some reason, I can't post the pic in .rtf or .doc, but the express cal has a fan1 and fan2 setting.

dimented24x7

iTrader: (2)

It was listed as an option in the schematics for the trucks, and the OBD routine to perform the diagnostics for the cool fan relay logic is there, but the actual control code was removed, and the diagnostics disabled. As I found out with the TBI PCMs, just because some came with a hardware option does not mean that the actual hardware is really there. It would not surprise me if they omitted everything but the trace on the board when they did away with the code. Not the end of the world as another output can be used, but it means disabling something like the AIR or EGR and patching in a new control routine.

CalEditor

You need to unzip the files with 7 zip.
When this is done it will drop the line/segment number off the end. Follow me on that? The Unzipped file number is one digit less.
----------
Give me a VIN or a year that they used the Electric fan on and I will post the bin.


one more thing. When you unzip the files with 7 zip they expand to the correct size.

CalEditor

Connector #4 pin #9.

I will find the RPO code and then find you a bin file.

The RPO is K02

"K02: Fan: Radiator Booster "

dimented24x7

iTrader: (2)

I can open them, and I see the readme.txt and each section of the calibration and OS, but the actual sections don't appear to be raw binary. The machine commands and padding appear to be absent. They are compressed, formatted, or otherwise encrypted in some fashion, unless there is some software that is used to open them?
----------
Cool. If you could get a vehicle application would be great. Connecting the dots from the hardware addresses to the actual outputs can be challenging sometimes, especially if the code isn't all there.

CalEditor

What is the size of the operating system?

I have 284kb

Wait I will un 7 zip it and repost just one.
It's not that hard to do. We do it all the time. They must be in 7 zip form to use with the MDI or Tech II.
This will work for you
98 350 auto 3.zip

Now you will need 7 zip to extract the files from the other folders.
The folder is WinZipped and the files are 7 zipped.

dimented24x7

iTrader: (2)

Ooohhhh. OK. So its basically zips within a zip. I see. Let me try them again.
----------
It works now. Sorry, didn't quite get what you where saying before.

dimented24x7

iTrader: (2)

Thats about right. Mine is 291kB less padding for the unused space/address overlap.

Its worth noting for general reference that they drop everything but the relavent data from the files (all files together != a full bin), but using a 512K binary template and the checksum spans at the start of the OS, they can be re-assembled into full working bins.

dimented24x7

iTrader: (2)

Also, if Im not mistaken, I think the 97 and 98 model year PCMs are different. IIRC, the 96/97 PCMs had a much different hardware layout than the 98+ PCMs. The 96/97 PCMs had dual QFP flash chips, and many other differences while the 98+ PCMs had the standard sector'd 28F400BX Intel Flash chip and condensed hardware layout like the newer computers

CalEditor

Correct
They come to me Zipped, but this forum won't allow for 7 zips.

CalEditor

The great thing about having separated segments is that you can look at them individually.

OK in the word doc you have a list of segments for each VIN. If you compare the Word doc's you will see differences. If you wanted to add a 4L80E to a 4L60E truck you could swap that segment. If you wanted to run a 454 in place of a 350 you could see what changes it needs. If you wanted to run a 350 TPI you could use the 454 segment (no crank sensor).
If you wanted to find the speed-limiter or tire size you would compare the speedo segments

When I find one with a booster fan you will do a comparison on that and find it also.

Hey it has worked for me, but sometime I do stuff the hard way.

VIN: 2GCEC19RXW
Controller: PCM/VCM Powertrain/Vehicle Control Module

Calibration for: Operating system
Part Number CVN Bulletin # Description
9365095 N/A - New software to eliminate false P1404 codes
--------------------------------------------------------------------------------
Calibration for: Engine
Part Number CVN Bulletin # Description
9364759 N/A 866503 New calibration to eliminate false P1404 codes, Bulletin Number 866503.
--------------------------------------------------------------------------------
Calibration for: Fuel system
Part Number CVN Bulletin # Description
16250416 N/A - Fuel system calibration
--------------------------------------------------------------------------------
Calibration for: System
Part Number CVN Bulletin # Description
16216223 N/A - Initial system calibration for production vehicles
--------------------------------------------------------------------------------
Calibration for: Speedometer
Part Number CVN Bulletin # Description
16188997 N/A - Speedometer calibration

--------------------------------------------------------------------------------
Calibration for: Transmission
Part Number CVN Bulletin # Description
16216106 N/A - Transmission calibration

--------------------------------------------------------------------------------

CalEditor

Correct on that. The communication protocol is different, but I didn't check the bins.
I couldn't find a 98 or 99 manual trans, so I added some 97's. You would need 3 or 4 to get something out on a comparison.