Bricked ECU - SH Boot Mode help!

[Merp]

I talked to one place today, they're finding the code on the ECU then they'll get back to me.

More info on my SHbootmode setup here. Pictures at the bottom.

[spark]

I talked to one place today, they're finding the code on the ECU then they'll get back to me.

Thanks in advance!

[Merp]

Hey, sorry for the wait, been really busy with school.

I found one ready to ship for $215 shipped to me. I also found a few for $100-150, but they are all still in the car, they will call me when they get them pulled out, which should be 2 weeks tops.

I also found one for ~$100, but it is a 22611AH63b, not sure if that works.

lmk what you want to do.

[spark]

see PM

[Merp]

Did some more testing today.

When my adapter isn't hooked up to the ECU, everything reads:
VCC: 5v
GND: 0v
TX/RX: 5v
WDS: 0v - 5v Square Wave @150Hz.

All this looks fine to me, I'm not sure what the TX/RX lines should read though.

Anyway, when soldered up to an ECU, things change.

Vcc => P405
GND => P413 => ECU pins D1,D2,D3,D7,A5 (connecting adapter and ecm grounds as Colby mentioned on OpenECU)
TX => P409
RX => P411
WDS => P407

This is while running:
12V POS => ECU pins B5,B19
12V NEG => ECU pins D1,D2,D3,D7,A5

I get the following readings with or without the 12V source applied
Vcc: 5v
GND: 0v
TX: 2.5v
RX: 2v
WDS: 0v - 2.5v Square Wave @ 150Hz

So, it looks like the ECU may be broken, or the pad numbers aren't corresponding to the proper CPU pins. I found a spare 04 STi ECU to test, will see how that goes, and I suppose I could scrap one of my ecu's to trace the pads if my cable is indeed working.

Can anyone who's sucessfully booted an ECU post the above readings when connected?

Thanks!

[subaruperm]

hi, sorry for my bad english))
i try flash my brick ECU from Forester EU 2004
i`m use FTDI232BM chip and 555 timer
use 12v power for ECU, pin POS - B5,6, NEG - B1,4, my ECU 'eating' ~ 370 mA

point p407 on Ecu have 150 mHz

but Ecu Flash not write my Ecu
i attached log:
[17:46:00.127] EcuFlash Version 1.41.2483
[17:46:00.127] OS Version Windows XP
[17:46:00.127] Qt Version 4.4.0
[17:46:00.127] 26 memory models read.
[17:46:00.127] scanning for metadata models in C:/Program Files/OpenECU/EcuFlash/rommetadata
[17:46:00.283] 342 ROM metadata models scanned.
[17:46:00.283] checksum module "subarudbw" loaded.
[17:46:00.283] checksum module "mitsucan" loaded.
[17:46:00.283] flashing tool "wrx02" loaded.
[17:46:00.283] flashing tool "wrx04" loaded.
[17:46:00.283] flashing tool "sti04" loaded.
[17:46:00.283] flashing tool "sti05" loaded.
[17:46:00.283] flashing tool "mitsukernel" loaded.
[17:46:00.283] flashing tool "mitsukernelocp" loaded.
[17:46:00.283] flashing tool "mitsubootloader" loaded.
[17:46:00.283] flashing tool "shbootmode" loaded.
[17:46:00.283] flashing tool "shaudmode" loaded.
[17:46:00.283] flashing tool "subarucan" loaded.
[17:46:00.283] flashing tool "mitsucan" loaded.
[17:46:02.877] A2WC420F (237 tables) inheriting 32BITBASE (662 tables)
[17:46:02.923] 524288 byte image read.
[17:46:03.892] Using interface USB <-> Serial
[17:46:04.970] sending bit rate sync bytes...
[17:46:06.502] no bit rate adjust response
[17:46:06.502] interface close
[17:46:36.814] Using interface USB <-> Serial
[17:46:37.970] sending bit rate sync bytes...
[17:46:38.080] received bit rate adjust response
sending boot command
[17:46:38.611] received bit rate adjust response
sending boot command
[17:46:39.127] received bit rate adjust response
sending boot command
[17:46:39.642] received bit rate adjust response
sending boot command
[17:46:40.173] received bit rate adjust response
sending boot command
[17:46:40.689] received bit rate adjust response
sending boot command
[17:46:41.220] received bit rate adjust response
sending boot command
[17:46:41.736] received bit rate adjust response
sending boot command
[17:46:42.252] received bit rate adjust response
sending boot command
[17:46:42.783] received bit rate adjust response
sending boot command
[17:46:43.298] received bit rate adjust response
sending boot command
[17:46:43.814] received bit rate adjust response
sending boot command
[17:46:44.345] received bit rate adjust response
sending boot command
[17:46:44.861] received bit rate adjust response
sending boot command
[17:46:45.392] received bit rate adjust response
sending boot command
[17:46:45.908] received bit rate adjust response
sending boot command
[17:46:46.423] received bit rate adjust response
sending boot command
[17:46:46.955] received bit rate adjust response
sending boot command
[17:46:47.470] received bit rate adjust response
sending boot command
[17:46:47.986] received bit rate adjust response
sending boot command
[17:46:48.517] received bit rate adjust response
sending boot command
[17:46:49.033] received bit rate adjust response
sending boot command
[17:46:49.548] received bit rate adjust response
sending boot command
[17:46:50.080] received bit rate adjust response
sending boot command
[17:46:50.595] received bit rate adjust response
sending boot command
[17:46:51.111] received bit rate adjust response
sending boot command
[17:46:51.642] received bit rate adjust response
sending boot command
[17:46:52.158] received bit rate adjust response
sending boot command

please, help me!!!

maybe i`m use wrong power pin for my Ecu? i find power pin in Subaru technikal documentation (like 2003-2004 Subaru Forester Service manual - Engine (H4DOTC) - Engine Diagnostics - MSA5T0722A162086 ECM IO signal.pdf)

maybe my Ecu dosnt go into boot mode, i connect to GND point number P413

thanks

[zee]

Hello, I put up the interface as show the http://www.openecu.org/index.php?title=SHBootMode but I'm having trouble so that Windows recognizes the hardware.

Where I can find the driver for installation on usb?

Also I do not see the datasheet of the micro the pins that I should connect. Which pins should I connect the interface?

I appreciate the help in advance.

Regards

Zee

[Nuke]

Ok, if someone can help me with this.

So I should be applying the 12v to both ignition switch AND backup power supply?

Then I just ground ignition system AND power supply?

[hmanxx]

Read this thread..viewtopic.php?f=2&t=4310&p=22301#p22301
I successfully recovered the ECU ..with slightly different approach than documented here

Instead of finding the 12V supply pins which are varying from car to car, you could jump wrong power to the ECU...I did a direct 5V supply and 3.3V Supply to SH7058 direct. Just use a ATX PC Power supply to do the job for 3.3V...with the SH7058 hardware manual , you can trace PVcc1 and PVcc2 and set it to 5V, Vcc(For I/O) to 3.3V,then the rest follow what is documented on the Wiki.

If you are modifying some circuit with FTDI chip for the flashing job, please download the FTDI EEPROM programmer to see whether the signals are inverted..Ecuflash work well with default FTDI setting.

[parso_rex]

I'm having similar issues trying to fix an ADM 07STI ECU. I'm using a modifed 1.3 openport cable with wirewrap wire connecting to the pins on an adjacent chip - pins are very small. I have a bench powersupply at 12 V and I built another circuit to supply 5V. I'm using a sig gen for the 125Hz WDT and watch everything with a CRO. Everthing looks correct. The FT232RQ in the 1.3 openport has a different pinout compared to the SHboot schematic but I've made sure this is correct. The ECU is powered at two points connected to a +12V supply and one gnd. All grounds and signals commoned
Its the same error as a few others, its as though there is not proper communication. What sort of handshaking should be occurring? I can't access CTS or RTX on the openport 1.3 so tiny you can't get to them!!

[14:58:59.750] received bit rate adjust response
sending boot command
[14:59:00.265] received bit rate adjust response
sending boot command
[14:59:00.796] received bit rate adjust response
sending boot command
[14:59:01.312] received bit rate adjust response
sending boot command
[14:59:01.828] no bit rate adjust response
[14:59:01.828] interface close

Assuming there is an issue with using the openport 1.3 FTDI like this, I've ordered one of these
http://www.dontronics-shop.com/ftdi-usb ... cable.html
If this is not working then i may end up going the way of the above post.
Any ideas ?

Cheers

Mark

[hmanxx]

Assuming the Hardware connection is correct..Did you program the FTDI chip found on 1.3U OpenPort to generic SerialComm setting. If you look carefully on the SHBOOT circuit ..the signal convention is not the same as the OpenPort 1.3U. I go straight to program the signal convention according to the SHBOOT Circuit and didnt try with default OPenPort 1.3U setting. WHat I figured out was the setting on 1.3 OpenPort is definitely different than the SHBOOT convention( active Low).

Below is the flash screen when it is successfully connected to SHBOOT Mode

[11:44:11.687] EcuFlash Version 1.41.2483
[11:44:11.687] OS Version Windows XP
[11:44:11.687] Qt Version 4.4.0
[11:44:11.703] 26 memory models read.
[11:44:11.703] scanning for metadata models in C:/Program Files/OpenECU/EcuFlash/rommetadata
[11:44:13.968] 344 ROM metadata models scanned.
[11:44:13.968] checksum module "subarudbw" loaded.
[11:44:13.968] checksum module "mitsucan" loaded.
[11:44:13.968] flashing tool "wrx02" loaded.
[11:44:13.968] flashing tool "wrx04" loaded.
[11:44:13.968] flashing tool "sti04" loaded.
[11:44:13.968] flashing tool "sti05" loaded.
[11:44:13.968] flashing tool "mitsukernel" loaded.
[11:44:13.968] flashing tool "mitsukernelocp" loaded.
[11:44:13.968] flashing tool "mitsubootloader" loaded.
[11:44:13.968] flashing tool "shbootmode" loaded.
[11:44:14.078] flashing tool "shaudmode" loaded.
[11:44:14.078] flashing tool "subarucan" loaded.
[11:44:14.078] flashing tool "mitsucan" loaded.
[11:44:23.390] 1048576 byte image read.
[11:44:26.578] Using interface OpenPort 1.3 Universal TX27Bv*tb39bf4d500000000000000000000000000000000
[11:44:29.437] sending bit rate sync bytes...
[11:44:30.968] no bit rate adjust response
[11:44:30.968] interface close
[11:48:17.781] Using interface OpenPort 1.3 Universal TX27Bv*tb39bf4d500000000000000000000000000000000
[11:48:20.906] sending bit rate sync bytes...
[11:48:22.437] no bit rate adjust response
[11:48:22.437] interface close
[11:58:06.125] Using interface OpenPort 1.3 Universal TX27Bv*tb39bf4d500000000000000000000000000000000
[11:58:08.187] sending bit rate sync bytes...
[11:58:08.296] received bit rate adjust response
sending boot command
[11:58:08.796] got boot response
[11:58:08.937] 1 supported device(s):
[11:58:08.937] 0601 HD64F7058
[11:58:08.937] selecting device 0601
[11:58:09.171] 0 supported clock mode(s):
[11:58:09.171] selecting clock mode 0
[11:58:09.421] 2 supported clock type(s):
[11:58:09.421] 2 ratios for clock type 1
[11:58:09.421] 2 ratios for clock type 2
[11:58:09.531] 2 supported clock frequency range(s):
[11:58:09.531] 1 20000000-40000000
[11:58:09.531] 2 10000000-20000000
[11:58:09.531] setting baud rate to 62500
[11:58:09.921] 1 user boot MAT area(s):
[11:58:09.921] 1 00000000-00001fff
[11:58:10.046] 2 user MAT area(s):
[11:58:10.046] 1 00000000-0007ffff
[11:58:10.046] 2 00080000-000fffff
[11:58:10.171] programming unit is 128
[11:58:10.296] one MAT programming supported at 00000000
[11:58:10.296] entering prog/erase state
[11:58:30.812] writing 128 bytes to 00000000
[11:58:30.953] writing 128 bytes to 00000080
[11:58:31.093] writing 128 bytes to 00000100
[11:58:31.234] writing 128 bytes to 00000180
[11:58:31.375] writing 128 bytes to 00000200
[11:58:31.515] writing 128 bytes to 00000280
[11:58:31.656] writing 128 bytes to 00000300
[11:58:31.796] writing 128 bytes to 00000380
[11:58:31.937] writing 128 bytes to 00000400
[11:58:32.078] writing 128 bytes to 00000480
[11:58:32.218] writing 128 bytes to 00000500
[11:58:32.359] writing 128 bytes to 00000580
[11:58:32.500] writing 128 bytes to 00000600

I dont provide 12V at all as I dont know which pin is the correct 12V supply pin and worry blowing up some chip on the ECU board..however I am very sure the location of Vcc of SH7058...thus i find it saver this way..

I did try my luck of not supplying the Watch Dog signal..and proven no luck without that..

[parso_rex]

Thanks for that info, I'm testing the new FTDI cable shortly hopefully I'll have a better result

[parso_rex]

Still no luck, when using the non openport FTDI I don't even get prompted with the popup just prior to the flash. The popup only appear when you've selected the alternate flash procedure option, its the one that mentioned building the shboot circuit.
So I'm guessing the prog is waiting for the right logic level to be seen on one of the pins. I.ve used FTprog to try inverting these but I'm thinking it might have to be tied properly. I also had a look at the openport cable and see what you mean about inverted pins, 2 were

Its not Ecuflash though, if i try with a 1.3 cable I get the prompt

[parso_rex]

OK back with the openport cable, I've programmed everything to default FTDI
Tested voltages at the processor pins and they are all correct
still no luck

[14:50:36.953] EcuFlash Version 1.42.2595
[14:50:36.953] OS Version Windows XP
[14:50:36.953] Qt Version 4.5.0
[14:50:36.968] 56 memory models read.
[14:50:36.968] scanning for metadata models in C:/program files/OpenECU/EcuFlash/rommetadata
[14:50:37.218] 343 ROM metadata models scanned.
[14:50:37.218] checksum module "subarudbw" loaded.
[14:50:37.218] checksum module "mitsucan" loaded.
[14:50:37.218] flashing tool "wrx02" loaded.
[14:50:37.218] flashing tool "wrx04" loaded.
[14:50:37.218] flashing tool "sti04" loaded.
[14:50:37.218] flashing tool "sti05" loaded.
[14:50:37.218] flashing tool "mitsukernel" loaded.
[14:50:37.218] flashing tool "mitsukernelocp" loaded.
[14:50:37.218] flashing tool "mitsubootloader" loaded.
[14:50:37.218] flashing tool "shbootmode" loaded.
[14:50:37.218] flashing tool "shaudmode" loaded.
[14:50:37.218] flashing tool "subarucan" loaded.
[14:50:37.218] flashing tool "mitsucan" loaded.
[14:50:48.328] A8DK100V (248 tables) inheriting 32BITBASE (662 tables)
[14:50:48.406] 1048576 byte image read.
[14:50:51.812] Using interface OpenPort 1.3 Subaru TX46y3yI588637d500000000000000000000000000000000
[14:50:53.937] sending bit rate sync bytes...
[14:50:53.953] received bit rate adjust response
sending boot command
[14:50:54.453] received bit rate adjust response
sending boot command
[14:50:54.953] received bit rate adjust response
sending boot command
[14:50:55.453] received bit rate adjust response
sending boot command
[14:50:55.953] received bit rate adjust response
sending boot command
[14:50:56.453] received bit rate adjust response
sending boot command
[14:50:56.953] received bit rate adjust response
sending boot command
[14:50:57.453] received bit rate adjust response
sending boot command
[14:50:57.953] received bit rate adjust response
sending boot command
[14:50:58.453] received bit rate adjust response
sending boot command
[14:50:58.953] received bit rate adjust response
sending boot command
[14:50:59.453] received bit rate adjust response
sending boot command
[14:50:59.953] received bit rate adjust response
sending boot command
[14:51:00.453] received bit rate adjust response
sending boot command
[14:51:00.953] received bit rate adjust response
sending boot command
[14:51:01.453] no bit rate adjust response
[14:51:01.453] interface close

it just doesn't get any further than this
The watchdog timer I'm using a 125Hz square wave from a sig gen I might try the 555 circuit tomorrow.
Mark

[parso_rex]

Tried everything and failed including a 555 to generate the watchdog and also two seperate interfaces programmed in many different ways. Its just wouldn't go into boot mode.
I will guess that its speed related or perhaps the ECU is beyond help. Unfortunately I have to give up on this as its wasted so much time
I'll try and get hold of another ECU at some stage and have another go

Mark