NefMoto

Technical => Flashing and Chipping => Topic started by: Nottingham on February 26, 2012, 10:34:25 AM



Title: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: Nottingham on February 26, 2012, 10:34:25 AM
Frankly I am getting quite desperate here...

I have a 06A906032RP (0261208521) ECU from a Ibiza Cupra, which I cannot get into the boot mode.
I have already tried everything I can imagine; different versions of Galletto program, different FTDI drivers, three different computers, resistors with different values (0ohm - 100k ohm), etc. Yet neither Galletto (boot mode inactive) or Nefmoto can connect in boot mode  >:( Nefmoto flasher connects in normal mode thou...

Someone else here in Nefmoto had exactly the same problems with this specific ECU.

I cannot see anything else being different compared to other ME7.5 ECUs I have seen, besides the CPU.
In this ECU it is made by Infineon (B00017) instead of Siemens.

So far it seems this ECU is impenetrable.
It cannot be read (RequestUpload rejected) or flashed(?) since the memory layout cannot be verified.

Any ideas?



Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: professor on February 26, 2012, 01:13:38 PM
Why you wanna put the ECU in boot mode? After flash failure?

I guess you ground the right boot pin.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: Nottingham on February 26, 2012, 04:10:06 PM
I have tried all the possible places (alternatives) for the boot pin, I tracked them with a multimeter.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: Nottingham on February 27, 2012, 12:43:44 AM
It seems the ECU is in boot mode.
Nefmoto flasher cannot connect in normal mode:

Code:
27.helmi.2012 09:20:01.524: LOG: Opened NefMoto VW Audi ME7 Flasher Logger 1.9.2.3
27.helmi.2012 09:20:04.649: LOG: Setting Address: 0x01 KeyByte1: 0x6B KeyByte2: 0x0F
27.helmi.2012 09:20:04.674: LOG: Opened FTDI device.
27.helmi.2012 09:20:04.674: LOG: FTDI device info - Description: VAG K+CAN Serial Number: A6007dAe Device Type: FT_DEVICE_232R ID: 0x4036001 Device Flags: 0x0
27.helmi.2012 09:20:04.674: LOG: FTDI ChipID DLL is loaded, checking chip ID...
27.helmi.2012 09:20:04.677: LOG: FTDI device chip ID: 0xC80FE7F9
27.helmi.2012 09:20:04.704: USER: Validated FTDI device is in dumb mode.
27.helmi.2012 09:20:04.707: LOG: Starting send receive thread.
27.helmi.2012 09:20:04.711: LOG: Send receive thread now started.
27.helmi.2012 09:20:04.712: USER: Disconnected
27.helmi.2012 09:20:04.737: LOG: Setting communication timings to defaults.
27.helmi.2012 09:20:04.738: LOG: Set timing parameters to defaults.
27.helmi.2012 09:20:04.738: USER: Connecting...
27.helmi.2012 09:20:04.752: LOG: Setting communication timings to defaults.
27.helmi.2012 09:20:04.754: USER: Starting slow init connection.
27.helmi.2012 09:20:07.354: USER: Connecting to address 0x01.
27.helmi.2012 09:20:10.161: LOG: Failed to read sync byte, guessing baud rate is actually 9600.
27.helmi.2012 09:20:10.203: LOG: Not enough key bytes, read: 0
27.helmi.2012 09:20:10.211: USER: Slow init failed.
27.helmi.2012 09:20:10.211: USER: Disconnected
27.helmi.2012 09:20:10.227: LOG: Setting communication timings to defaults.
27.helmi.2012 09:20:10.227: USER: Connecting...
27.helmi.2012 09:20:10.238: LOG: Setting communication timings to defaults.
27.helmi.2012 09:20:10.238: USER: Starting slow init connection.
27.helmi.2012 09:20:12.838: USER: Connecting to address 0x01.
27.helmi.2012 09:20:15.641: LOG: Failed to read sync byte, guessing baud rate is actually 9600.
27.helmi.2012 09:20:15.683: LOG: Not enough key bytes, read: 0
27.helmi.2012 09:20:15.690: USER: Slow init failed.
27.helmi.2012 09:20:15.691: USER: Disconnected
27.helmi.2012 09:20:15.701: LOG: Setting communication timings to defaults.
27.helmi.2012 09:20:15.702: USER: Connecting...
27.helmi.2012 09:20:15.712: LOG: Setting communication timings to defaults.
27.helmi.2012 09:20:15.713: USER: Starting slow init connection.
27.helmi.2012 09:20:18.313: USER: Connecting to address 0x01.
27.helmi.2012 09:20:21.115: LOG: Failed to read sync byte, guessing baud rate is actually 9600.
27.helmi.2012 09:20:21.157: LOG: Not enough key bytes, read: 0
27.helmi.2012 09:20:21.165: USER: Slow init failed.
27.helmi.2012 09:20:21.165: USER: Disconnected
27.helmi.2012 09:20:21.176: LOG: Setting communication timings to defaults.
27.helmi.2012 09:20:21.179: LOG: Closing FTDI device.
27.helmi.2012 09:20:21.188: LOG: Send receive thread now terminated.
27.helmi.2012 09:20:28.946: LOG: Closing NefMoto VW Audi ME7 Flasher Logger 1.9.2.3

But neither in boot mode....

Code:
27.helmi.2012 09:18:49.384: LOG: Opened NefMoto VW Audi ME7 Flasher Logger 1.9.2.3
27.helmi.2012 09:19:02.128: LOG: Opened FTDI device.
27.helmi.2012 09:19:02.128: LOG: FTDI device info - Description: VAG K+CAN Serial Number: A6007dAe Device Type: FT_DEVICE_232R ID: 0x4036001 Device Flags: 0x0
27.helmi.2012 09:19:02.128: LOG: FTDI ChipID DLL is loaded, checking chip ID...
27.helmi.2012 09:19:02.131: LOG: FTDI device chip ID: 0xC80FE7F9
27.helmi.2012 09:19:02.148: LOG: Starting send receive thread.
27.helmi.2012 09:19:02.149: LOG: Send receive thread now started.
27.helmi.2012 09:19:02.150: USER: Disconnected
27.helmi.2012 09:19:02.161: USER: Connecting...
27.helmi.2012 09:19:02.185: USER: Starting bootstrap loader upload.
27.helmi.2012 09:19:02.189: USER: Sent bootstrap init zero byte.
27.helmi.2012 09:19:05.193: USER: Sent bootstrap init zero byte.
27.helmi.2012 09:19:08.196: USER: Sent bootstrap init zero byte.
27.helmi.2012 09:19:11.196: USER: Bootstrap loader upload failed. Failed to receive device ID response for init zero byte.
27.helmi.2012 09:19:11.196: USER: Disconnected
27.helmi.2012 09:19:11.204: USER: Connecting...
27.helmi.2012 09:19:11.211: USER: Starting bootstrap loader upload.
27.helmi.2012 09:19:11.214: USER: Sent bootstrap init zero byte.
27.helmi.2012 09:19:14.217: USER: Sent bootstrap init zero byte.
27.helmi.2012 09:19:17.220: USER: Sent bootstrap init zero byte.
27.helmi.2012 09:19:20.220: USER: Bootstrap loader upload failed. Failed to receive device ID response for init zero byte.
27.helmi.2012 09:19:20.220: USER: Disconnected
27.helmi.2012 09:19:20.228: USER: Connecting...
27.helmi.2012 09:19:20.235: USER: Starting bootstrap loader upload.
27.helmi.2012 09:19:20.238: USER: Sent bootstrap init zero byte.
27.helmi.2012 09:19:23.241: USER: Sent bootstrap init zero byte.
27.helmi.2012 09:19:26.245: USER: Sent bootstrap init zero byte.
27.helmi.2012 09:19:28.246: USER: Bootstrap loader upload failed. Failed to receive device ID response for init zero byte.
27.helmi.2012 09:19:28.246: USER: Disconnected
27.helmi.2012 09:19:28.256: LOG: Closing FTDI device.
27.helmi.2012 09:19:28.265: LOG: Send receive thread now terminated.
27.helmi.2012 09:19:58.304: LOG: Closing NefMoto VW Audi ME7 Flasher Logger 1.9.2.3

Without the boot mode Nefmoto flasher connects fine in normal mode.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: professor on February 27, 2012, 01:20:44 AM
I am asking the same, why did you want to put the ECU in boot mode? After flash failure? Or something else?

Also the fact that memory layout can not be verified perhaps shows that 29F800BB is corrupted.

BTW i get the same nefmoto boot mode messages.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: Nottingham on February 27, 2012, 01:28:46 AM
The car probably has a expired aftermarket trial I want to get rid of.
Atleast I want to know what is it.

The ECU is otherwise working fine.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: pvl on February 27, 2012, 02:13:50 AM
There's nothing like a crypted flashromsocket soldered into the ecu, right ? plain obd2-programmed stuff ?

Picture of internals please.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: Nottingham on February 27, 2012, 02:36:17 AM
Just closed the casing, gave up eventually...
The ECU has never been opened before, no scratches anywhere and the seal string was intact.

Tried Minimon too, it cannot connect either.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: Nottingham on February 27, 2012, 03:14:00 AM
Pictures as attachment.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: pvl on February 27, 2012, 03:38:55 AM
Red : bootpin-pad
Blue : jumperwire

place or solder jumperwire with one side on the pad, or flashrompin.

temporarily ground the other side of the blue wire to the edge, like shown, while powering-on
the ecu. After 1 sec, release the jumperwire so it does not make contact anymore with ground.

fire up galetto software, choose bootmode 1MB chip / amd 800 and it should be possible to get a ecu-id.

I use the 1260 version. Never had ANY problem with bootmode. But it's not really needed. These can be
done with Kwp2000 on the bench or even better with MPPS on the bench or in the car via obd to rewrite.

I think the issue lays with powering-on and feeding all correct pins with power. I made myselfe a bench-
harness with switch to simulate ignition-key-switch. Works a treat.

Did you test your interface on other ecu's ? Is the interface o.k. ?



Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: Nottingham on February 27, 2012, 03:51:54 AM
Just triple checking: Pin 62 (12V) should be live (connected to 12V) before the bootpin is shorted to ground, and while the BP shorted the ECU is powered up by feeding 12V to the ignition (pin 3)?


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: pvl on February 27, 2012, 04:51:37 AM
Reading back your posted logfile of nefmotoflasher :

FTDI device info - Description: VAG K+CAN Serial Number: A6007dAe Device Type: FT_DEVICE_232R ID: 0x4036001 Device Flags: 0x0


HELLO... which USB-dongles does nefmoto support ?  ::)

NOT that dashboard-tool ;) 

Don't you have a cheap usb-KKL-dongle laying around ? Or a mate ?  Oh.. it won't work on the bench due to the immo.
Get a real tool, like MPPS V12 for this. A wise investment ;)

Regarding the chicken-interface (english translation for italian 'galletto') , the pinout for giving correct power to the ecu:

http://nefariousmotorsports.com/forum/index.php?topic=1541.msg14808#msg14808

I thought i didn't connect pin 21, as this is not needed, and never needed it anyway ;)

Pin 3 is defo switched 12v-ignitionkey. And that must be switchable, when appyling the temp-bridge-wire for bootmode-activation.

If you hook it up, like the picture from the thread, you are good to go. Also for vagcom-diagnosis (HINT !!!)

When this is not possible, with this pinout (vagcom-diagnosis on the bench) your ecu has big problems. I feed 12v directly from a
NEW carbattery and a charger feeding the battery. Most stable and good for flashing&testing ecu's.

You do have the galletto 1250 or 1260 obd2 dongle don't you ? As that K+CAN won't work with galletto-software...  ;)

Cheers,

PvL


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: Nottingham on February 27, 2012, 04:57:07 AM
Thanks for making it fool proof, but the VAG K+CAN clone cable works fine with Nefmoto and other software that require a dumb interface ;)

And I do have a Galletto 1260 too, naturally.

In normal mode Nefmoto can connect and read the ECU information, however it cannot do anything else as Immo is enabled.

In boot mode, still neither Nefmoto or Galletto can connect.

I used the surrounding foil as a ground point like you suggested, everything however remains the same.
And I am switching the ignition signal so it should not be the issue.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: pvl on February 27, 2012, 05:13:00 AM
Hi,

Yes, just ruling-out any mistakes ;)  They are easily made with this stuff. Tho i had the luck i had instant success after doing homework...

Keep that pin 3  not powered, but the pin 62 is essential. thats the 'cleanup/backup power' .

It can be very well that you have a corrupted EEprom (the little 8pin 95040) on the BACK of the ecu, in the middle)) And therefore have
issues/difficulties getting into bootmode.

Is it possible to use your K+can software and do a dump of it ?  I had once a UK-ecu with a revo-trial on it. I guess that was thrown on ebay,
because it had similar issues like you just summed-up in the thread. I firstly reprogrammed the 95040 and then had no issues with Galletto
to enter bootmode. The eeprom was filled with Revo as text when trying to read the eeprom via vag-K-commander v1.4. Really funny to see.

So, hook-up power as sayed, bridge the bootpin to ground (and keep it bridged), witch-on simulating ignition (pin 3) undo the temp-bootpin-bridge
and fire-up galletto.

I prefer WIN-XP-SP3 NON virtual-pc machines for this. they ALWAYS work. Others : you can run into serious compatibility-issues, and keep on searching
the cause untill you grow a big beard in the meantime..... and found out what it was.... 

let's see if it now works :)



Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: Nottingham on February 27, 2012, 06:00:44 AM
Nope, still nothing.

Maybe it is possible to disable the boot mode by modifying the 32k uP code inside the CR167.
Revo (and most likely APR too) can atleast read the memory without even opening the ECU.
Maybe they can write it too.

Someone should debug their flashing programs and see what they do.
I don´t think the Revoread (Flash, 32k uP reader) is even protected.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: sn00k on February 27, 2012, 07:41:43 AM
Tried using a bootloader to do a "clean" boot of the cpu and read the eeprom directly? (bootmode activated upon cpu boot)

Bootmode of the cpu can never be "turned off" by software, alltho changing the bootloader might screw things up for galetto and similar software.

compare the eeprom contents to a stock eeprom.

NO software changes can EVER block this method since the CPU never runs any code but your own bootloader and then dumps the eeprom contents into a file.. or writes to the eeprom, 100% intact, if needed to..
(there are some ways to doing this, but the easiest for you might be to grab the "me7_95040" tool located on this forum, and have a look inside that eeprom)


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: pvl on February 27, 2012, 08:13:03 AM
Sorry wrong post...  can't delete sadly...  :(


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: pvl on February 27, 2012, 08:32:49 AM
Sorry, wrong post....


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: Nottingham on February 27, 2012, 08:48:19 AM
Got so pissed that hacked the POS Galletto in thousand pieces.

Installed the ECU back in the car, no trouble what so ever.
It runs just like before.

I attached my EEPROM dump.
VIN and IMMO ID sensored (checksums corrected afterwards).

Take a look if you find time.

Thanks


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: pvl on February 27, 2012, 09:24:41 AM
Glad that nothing was broken.

Emm, i think people should grab a MPPS instead of a galletto. They are also capable of bootmode, and
support alot (more) newer ecu's.
There is always the kwp2000+ with the me7-version software to use (via obd) but this also gives issues
like the Galletto.

Bootmode is mostly NOT needed to do a read of the flashrom. And a last sort of option to read-out the flashrom.

I suggest to let the ecu relearn it's adaption-values to give back your stock power. Mostly after reverting back
to stock, the original program is completely restored, but to nag customers that didn't buy, they leave crappy
values in the EEprom so the car drives not too well (less performance than stock).

I don't think anything of the original program (tuned version) is left in the flashrom..... So reading it out will only
give you your current original normal software.

Cheers,

PvL


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: Nottingham on February 27, 2012, 06:51:36 PM
I just cannot figure out why is the "RequestUpload" service disabled in the current flash, if it is a factory stock file.
At the moment I cannot even flash the ECU with a properly tuned file if I wanted to. I am pissed because I don´t know how and why I am completely locked out of my own ECU :D

I´ll purchase a Willem programmer and solder out the flash chip.
I wasted so much time trying to read it over OBD that I would have had physically removed and reinstalled the flash atleast fifty times in the same time.

If I ever find these problems with boot mode was caused by APR, Revo or by any other companys trial software...
Their local branch office is going to ignite ;)

 


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: pvl on February 27, 2012, 07:24:36 PM
@ Nottingham :

Don't you perhaps know a friend in your neighbourhood that has a MPPS interface (and hopefully a v12 or newer) ?
that one can or should be able to do it via OBD and also via bootmode.

Your RP-ecu is a very specific one, and another forum-member also has BIG trouble with it. So the sympthoms are not new ;)

http://nefariousmotorsports.com/forum/index.php?topic=1369.msg12793#msg12793

Try MPPS please., if possible. It should be able to read and write it straight via obd !!!!

http://www.ebay.co.uk/sch/i.html?_nkw=mpps+12&_sacat=0&_odkw=mpps&_osacat=0&_trksid=p3286.c0.m270.l1313

Cheers,

PvL


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: Nottingham on February 27, 2012, 08:04:15 PM
Fine, I am going to order both of them (MPPS and Willem) once it is pay day ;D


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: AmIdYfReAk on March 02, 2012, 09:58:07 AM
Just wanted to make a note,

At times when boot mode is being a pain for me.

Turn the Power off, but leave the Switched/constant power connected.
Jump/short the flash,
Turn the power supply on,
Count till 10
remove short.

its worked *EVERYTIME* for me, even for those real stubborn ones :D

That is using a Gal 1260 Chinese Clone cable/program.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: Nottingham on March 02, 2012, 01:32:45 PM
I recon this ECU is different electrically.
Maybe there is "extra" resistor between CR167 P.0L4 pin and the usual boot pin (connected to AM29F800 pin 24).
In this case the CPU would not recognize P.0L4 pulled "low" (i.e ground).

Someone who has a ECU with boot mode working in hand, could you please measure the resistance between CR167 pin P.0L4 and ground? (while ecu fully detached from any wires). Directly from the CPU pin, not from the usual contact used for boot mode.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: ArgDub on March 02, 2012, 09:35:32 PM
The boot mode feature is embedded in microcontroller, there is no way you can turn it off. Doesn't matter if some tuner altered the eprom or flash memory, you can even completely remove the eprom IC and flash IC and you still will be able to enter boot mode. There is no way to disable boot mode!!

Maybe it is possible to disable the boot mode by modifying the 32k uP code inside the CR167.
Revo (and most likely APR too) can atleast read the memory without even opening the ECU.
Maybe they can write it too.

It can be very well that you have a corrupted EEprom (the little 8pin 95040) on the BACK of the ecu, in the middle)) And therefore have issues/difficulties getting into bootmode.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: Nottingham on March 02, 2012, 09:44:13 PM
The ECU goes into the boot mode just fine, however no software (Galletto, Nefmoto or ME7_95040) can connect to it while in boot mode. As long as it is in normal mode every software connects just fine, however they cannot read the flash because "RequestUpload" service is disabled.

The eeprom contents are fine too, the car runs without any problems.



Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: ArgDub on March 02, 2012, 11:01:55 PM
If you cant connect with Galletto, Nefmoto or ME7_95040, how do you know the ecu is in boot mode?

The ECU goes into the boot mode just fine, however no software (Galletto, Nefmoto or ME7_95040) can connect to it while in boot mode. As long as it is in normal mode every software connects just fine, however they cannot read the flash because "RequestUpload" service is disabled.

The eeprom contents are fine too, the car runs without any problems.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: Nottingham on March 03, 2012, 04:54:17 AM
It stops connecting in normal mode with Nefmoto or VCDS.

Also I am not the only one with exactly the same problems.
Nickname "professor" shares these problems here on Nefmoto.

The ECU (06A906032RP) is very rare since it is only installed in Seat Ibiza Cupras (made less than 5000).

I checked the C167 datasheet and it specifies that the pull-down resistor size should be 8k ohms to launch the boot strap loader.
I´ve tried different resistors too, but not exactly 8k I recon. Need to try that, connected directly the CPU pin.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: ArgDub on March 03, 2012, 06:21:36 AM
Not being able to connect with vcds doesn't mean you are in bootmode, seems you are not in bootmode to me.

Just triple checking: Pin 62 (12V) should be live (connected to 12V) before the bootpin is shorted to ground, and while the BP shorted the ECU is powered up by feeding 12V to the ignition (pin 3)?

Try connecting together pin 3 and pin 62, then ground the bootpin while feeding pin 3 and pin 62 with power at the same time.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: Nottingham on March 03, 2012, 06:28:03 AM
If I turn on the voltage for both pin 3 and 62 at the same while the boot pin is grounded, the ECU will boot in normal mode.

If voltage is turned on for pin 3 (while pin 62 already powered) and the boot pin is grounded, the ECU boots up but is not able to connect in normal or boot mode (with any software).


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: ArgDub on March 03, 2012, 07:24:11 AM
Seems P0L.4 is not at low level when you feed uP with power. What pin are you using as bootpin? Can you solder a wire directly to uP bootpin (PL0.4)?

 


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: Nottingham on March 03, 2012, 08:39:51 AM
I will try using P.0L4 pin directly thru 8k resistor next time.
If that does not work I will try without the resistor.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: Nottingham on March 06, 2012, 09:40:29 AM
God damn it.

There is nothing extra between the C167 P.0L4 pin and the usual boot pin.

MPPS V12 -> cannot connect in boot mode.
Galletto -> cannot connect in boot mode.

Tried the specified 8k resistor too.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: pvl on March 06, 2012, 09:52:09 AM
Hi,

Did you try normal mode, in MPPS ? Thus no bootmode, but straight reading ?

That must work... 

On the bench and in the car. Hope you can try this out, and report back please.

PvL


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: Nottingham on March 06, 2012, 10:33:27 AM
In normal mode MPPS returns "Error reading ECU" just like I expected.
It reads the ECU information correctly but cannot read the flash contents.

This is not a surprise, but the lack of boot mode is.
The CPU is not working as the datasheet specifies (BSL activation method).

GQ-4X will be the next step.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: professor on March 06, 2012, 11:15:56 AM
Always read the updates on this topic.
You ll desolder the eeprom and flash? Or read them on board?

Keep trying i wish you to solve the problem.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: pvl on March 06, 2012, 01:25:04 PM
Hi,

MOST amazing...  Stunned by the problems, reading this damn ecu :(

I also have a GQ-4X, but never had to use it for v.a.g. ecu's. This one
is a special one. You're sure there isn't a tune in already ? As that could
prevent this reading-out stuff. Desoldering the flash and the eeprom
will tell the tale :)

Please keep us informed about this matter.

Thanks,

PvL


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: Nottingham on March 07, 2012, 06:06:59 AM
Did some reading on the full version of Siemens C167 datasheet.

There are other conditions that must be met in order to launch the BSL mode (properly).

The CPU has a "Special Operations Mode" (SMOD) which is controlled via P0L.2, P0L.3, P0L.4, P0L.5.
During hardware reset the CPU monitors signal levels on these pins (HI/LO).

For normal start mode all of the signals should be set HI during hardware reset:

Code:
P0L.2 = 1 (High)
P0L.3 = 1 (High)
P0L.4 = 1 (High) - a.k.a "the boot pin"
P0L.5 = 1 (High)

For SBL mode the signals should be set as follows (exactly what has been done during all these years):

Code:
P0L.2 = 1 (High)
P0L.3 = 1 (High)
P0L.4 = 0 (Low) - a.k.a "the boot pin"
P0L.5 = 1 (High)

The CPU sees signal being low if P0L.x -> Vss = 8k ohms (lower seems to work too).

However these two modes (normal & SBL) are the only modes that the CPU supports.
Any other P0L.2 - P0L.5 combinations can cause "undefined behaviour and should not be used" (according to the datasheet).

I made some measurements directly from the pins of the CPU and everything looks fine.
In power down mode the CPU is strapped to start in normal mode (P0L.2-5 are set to high; 4.6M - Vss).
Since this is obviously the case during power up I checked if altering the resistance between P0L.4 and Vss also alters the resistance on any other P0L.x pins, i.e pulls the low: -> Nope.

After this one was a dead-end I started tracking the pcb traces to see if there is any component which could pull any of P0L.2, P0L.3, P0L.5 signals low in case P0L.4 is being pulled low. The only chip on the PCB which has connection to all of the P0L.x signals (besides the C167 and AM29F800 flash) is the Bosch 30380 IC. This chip also has some kind of reset controlling feature for the CPU so it might well be behind all of the hassle.

Can anyone check the codes written on Bosch 30380 IC from a ECU with boot mode working properly?


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: rajivc666 on March 07, 2012, 07:33:30 AM
I can totally understand your plight as I had fried my 06A906032sg while putting it in bootmode for the first time. I remember doing all this you have done. well the pin P0L.4 is connected to a total of three other chips besides c167.AM29F800 and 2 other ,one chip on to the left of the AM29F800 when looking from the direction of AM29F800 and one on the other side of the board just below the AM29F800. Finally I gave up and bought an ecu off ebay for 40 pounds of the same engine code as mine (aum) an 06A906032hj.  Many are available , search using either 06A906032 or 06A 906 032. I dumped my 06A906032sg eeprom into the new ecu using Argdub's ME7_95040 and flashed the stock 06A906032hj code with nefmoto (had to do this as the car was not starting) and was good to go. Hope it helps.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: pvl on March 27, 2012, 06:03:35 PM
Hi Nottingham,

About that ecu you have...  06A906032RP ...  I might have an interesting piece of info about it.

Did you already desoldered the flashrom, and read it out via the GQ ?  Ifnot, it might not be needed
to check one thing. I have a UK-mate that wanted to help a friend with his S3 to tune it. I helped
him out via teamviewer-session and via mpps we where able to read the thing, like normal. Well
the thing really wanted 13.5 volts to get a stable read, and the dashfuse pulled. Then we tried to
write the tune to it. That was a no-go. Then i looked to the read-out code. And i saw : REVO (C).

It was a 'reverted to stock' demotune. What the buggers of Revo do (and perhaps also APR) is blocking
ALL write-options, via OBD AND bootmode. Even when the ecu is pulled you can't communicate via
K-line to get some diags going via vagcom !!! The ecu is not findable !  (on the bench, via benchflashlead).

We tried bootmode, with nefmoto and mpps : no go.  So therefore i suspect you have a reverted trial
in yours. And user 'professor' might be having the same issue !!.

My friend's brother that works @ a revo-dealer, told him that they block the bootmode and only their
tool is able to revert it back to real original stock back. So that might be your case.

You can try it out, reconnecting the ecu to the car, undoing the dashfuse (clocks go numb), and be sure you
have 13.5 volts reading in the lower left corner of mpps screen.

Then all should be fine to read-out. 

Would be nice if you could tell us forumpeeps if you succeeded. 
Ifnot, try it with dashfuse in place. But one thing is really needed : proper battery+tricklecharger power !! 

Not only the flashrom is modified b.t.w.  Also the e2p 95040 immo-chip. Therefore it's such a nightmare
without solderingtools or Reveo themselves cleaning up their mess, to program a reverted or revo tuned
ecu.

Cheers,

PvL


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: kls on March 27, 2012, 10:29:47 PM
If bootmode is built into the processor itself then no changes to the flash or eeprom will prevent it from operating.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: pvl on March 28, 2012, 02:06:34 AM
Hopefully, like the stated S3 in previous message from me, the car is readable when the ecu is in the car.
By afterwards comparing the read-out to the original file (if available on the net) it becomes clear that
it has modified software inside.

@ KLS:  it is theorethically very nice to post info, but in reality things may differ a bit. Let's hope Nottingham
is able to read it out in his car like we did with the audi S3, and show the same we encountered.

If you have a alternative method to bypass this REVO protection against bootmode (and perhaps APR uses the
same way), you are welcome to say so.

Oh and another thing : NO communication whatsoever was possible when the ecu was taken out of the
car and putted on the workbench, and hooked-up via a benchflash lead. It was playing 'dead' like o.p. Nottingham
and forummember 'professor' have encountered.

But once placed-back in the car, all was normally working ?!?!?

B.T.W. if other forummembers have a non-soldering solution for this, do chime-in please. All help is welcome.

PvL


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: professor on March 28, 2012, 02:20:30 AM
Read & flash eeprom and flash memory while soldered in the board isnt possible via clips and universal programmer?


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: sn00k on March 28, 2012, 06:21:51 AM
If bootmode is built into the processor itself then no changes to the flash or eeprom will prevent it from operating.

correct, thats all there is too it.. there is no "MAGIC super-protection" preventing this, it is just not possible tp prevent.
find/write an own bootloader that dumps the contents of the EEPROM and flash into 2 files on the computer, NO other code is run but your own.. surely the cpu is set in bootmode, but the tools you are using are specifically blocked.(galetto etc).

the only way to disable bootmode is to desolder the cpu, trash it, order a new cpu, program it with different instructions and solder it in place, and no need to tell you this has NOT been done to these ECUs.

what IS possible is a hardware scrambler solderd between the flash/eeprom and the chip, but you should be able to identify this one pretty easy just by looking at it.. im not aware of any chips with built in scrambler.. yet.. but you would easily see if the chips have been desolderd/swapped or not.

the flash and eeprom chips, are them the same sizes as the oem chips? i remember a protection beeing written for earlier bosch ecus, which filled the normal prom with crap, like "REVO REVO REVO..." and then after the normal code-space the new code was placed.. with a simple remap for the ecu to start reading at the second place.. the ecu does support larger flash/proms with the same pinout.. just a thought.

keep trying, im sure you will figure it out eventually =)
would love to get my hands on one of these ecus myself for some testing =)


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: pvl on March 28, 2012, 07:42:41 AM
I see. But writing code ain't really my thing. To bypass the security.

Even normal vagcom k-line diagnostics are blocked on the bench. No ecu found. But in the car it works fine ?!?!?

@ Snook :

Time to share the readout of the 'original' file. Look in the code @ the end..  you'll see some advertisement.

I also included the real original.  The reverted demo does indeed 225bhp on the dyno. So the claims that it runs
less good than before the demo was installed are as of proof of this car not real. People been saying that when
it reverts back to stock, it has less bhp than stock-original.

Cheers,

PvL



Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: IamwhoIam on March 28, 2012, 07:53:17 AM
How much current does your ECU draw on the bench? A failure to communicate with VCDS seems to indicate that ECU isn't powered up properly, nothing more.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: pvl on March 28, 2012, 08:05:27 AM
@ IamwhoIam :

Mpps showed a healthy 13.5v ........ on the bench

Same voltage that was there when we read-out the ecu in the car.

Can't see any issues with this voltage. Benchcable also includes a M3.8.3 ecuconnector and
that one is 100% running. diags+progamming works flawless. So we do not suspect any voltage-
issues. The benchflashlead is 100% checked. No worries.

PvL


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: kls on March 28, 2012, 08:38:43 PM
There is no way K-line diags are going to be blocked on the bench. Something is being overlooked, if the ECU is acting dead then its not powering on. Its time to check the connections to it and see what is missing.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: Nottingham on March 29, 2012, 05:20:40 AM
In my case the K-Line traffic is not blocked, only the flash contents cannot be read due the upload service is disabled.

I´m 99% sure that Bosch has made changes to newer ECUs to prevent using the boot mode.
Most likely the "Bosch 30380" chip pulls the other P0L.x pins low too (which would start the CPU in "undefined behaviour" mode) in case it detects P0L.4 being pulled low.

I don´t have access to proper soldering equipment right now so I cannot "rig" the CPU pins to fixed signaling levels.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: pvl on March 29, 2012, 12:47:29 PM
@ nottingham :

Would you be so kind, to test normal communication (thus NON bootmode) with the MPPS, if you are able to read-out your ecu. (you might need to pull a dash-fuse, as i had to do with the S3)
I achieved a full read-out the content of the flashrom 100% ! 

By doing this we can see if the cause of this issue is to blame to a reverted demo.... (if read-out succeeds, a simple hex-editor comparison with the real original file tells the tale...)

Thanks,

PvL


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: Rick on July 22, 2012, 09:14:21 AM
Just had to boot load one of these, they are a little trickier as one of existing boot pins is already grounded.

Rick


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: professor on July 22, 2012, 11:59:22 AM
Just had to boot load one of these, they are a little trickier as one of existing boot pins is already grounded.

Rick
What do you mean?

professor


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: Rick on July 30, 2012, 03:34:09 AM
There is more than one boot pin, one is grounded from factory.  If you boot the usual one then two are grounded and the Processor won't respond at all.  So you have to unground the first pin, then you can enter boot mode as you would with ME7.5 etc.

Rick


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: professor on July 30, 2012, 07:25:12 AM
There is more than one boot pin, one is grounded from factory.  If you boot the usual one then two are grounded and the Processor won't respond at all.  So you have to unground the first pin, then you can enter boot mode as you would with ME7.5 etc.

Rick
Weird cause we boot mode the usually way.
Glad you mention it. Can you determine where the factory grounded pin is located with a photo?

Cheers,
professor


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: Rick on August 01, 2012, 02:03:30 AM
Sorry, need to point out I was talking about ME7.1.1 of which there are 4 versions I've come across, and they all have different methods of boot.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: hipeka on August 08, 2012, 08:56:56 PM
Sorry, need to point out I was talking about ME7.1.1 of which there are 4 versions I've come across, and they all have different methods of boot.

Do you mean this (Look at the pics) ?


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: Nottingham on August 15, 2012, 07:25:55 AM
If I ever find these problems with boot mode was caused by APR, Revo or by any other companys trial software...
Their local branch office is going to ignite ;)

SON OF A BITCH  >:(

Finally found time to desolder the flash and read it with Willem...

And, what do my eyes see?

"Seat Ibiza Cupra R EURO MY2005 1.8T 06A906032RP S0010 Stages 1/2 V2.0.Stock.98 Octane (RON) V2.0"

Currently looking at the map to locate the nearest APR reseller...


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: Nottingham on August 16, 2012, 08:57:29 AM
I was wondering why the binary is not even close to stock, if it is supposed to be a stock map.
There is plenty of shuffling and A LOT data added.

Tried to play with the cruise control today...
It is actually a full APR map, program 1 (stock) was the current selection.
No wonder the power figures were same as stock.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: gregsback on August 16, 2012, 10:41:32 PM
Hi Nottingham,
I have had same problem in the past with one ECU (RS4,....551K). And I still have this ECU and found out the following:
 if I ground both pins for power supply before going to boot mode then I can get into boot mode.
I can reproduce this effect as often as I want. If I do not ground the power lines (plus and minus) I can not get into boot mode. I saw a post in this forum where somebody had same problem, and he could once get into boot mode after several days  of not operating (with disconnected power) the ecu. After getting into boot mode once he again had to wait several days.
maybe this could be a solution for your basic problem? Even though I can not explain the phenomena... :) :)
 
br
Greg


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: nyet on August 16, 2012, 10:46:02 PM
uh shorting plus to ground is always a bad idea


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: Nottingham on August 17, 2012, 12:34:14 AM
He is discharging the charge from the capacitors  :o

Maybe the internal RAM is able retain the data because of the charge in the caps.
And because the RAM is not empty the CPU does not enter in boot mode.

Sounds odd but I guess it could be possible in theory.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: gregsback on August 17, 2012, 01:09:50 AM
Hi guys,
Maybe I was not clear enough - sorry. ground is not minus.
connecting plus and minus in´s in deed no good idea....

And: I fully agree, this all might sound strange. But if you want to be convinced: I still have this ECU and I can reproduce this as often as you want. I was about to throw the ECU away because I could not get it in boot mode. But then I saw this discussion about grounding the power supply :)
now everything is fine again   ;D

maybe simply try it Nottingham and give a feedback...

BR
Greg


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: professor on August 17, 2012, 01:19:46 AM
Is it possible to make a video while reproducing it ?

Cheers  :)


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: gregsback on August 17, 2012, 02:35:38 AM
Hi,
Hmm, in Theorie yes. I'll try... :)
BR
Greg


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: itemonsale on March 06, 2013, 07:59:00 PM
Did you have any solution with the Infineon chipset beside using a chip burner?



Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: krazydbiker on March 15, 2013, 04:37:11 PM
how are you trying to set it in bootmode, my volvo is later me7 with Infineon chip, and if you ground it out, the ECU is toast, you must use a 1k ohm resistor on the bootpin, otherwise you see one spark on initial contact, and then nothing, ever again


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: itemonsale on March 19, 2013, 12:02:38 PM
There are few members reported successfully get in to boot mode by grounding it without using a resistor.  You are right about the spark, but mainly that pin was grounded without any power to the unit at least in my case, however I can't get it in to boot mode but It start normal and drive normal after I put it back to the car.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: krazydbiker on March 20, 2013, 05:31:08 AM
just trying to help because it seems like you did exactly what i did

check this out
http://oldwww.rasip.fer.hr/academ/courses/compproc/docs/chap13.pdf


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: Three77 on November 16, 2013, 09:04:21 PM
I'm pretty late to this party, but I found this thread while searching for a solution to the same problem. I purchased an Ebay ECU and cannot get a flash read in any way. For kicks I tried the attached utility and ended up with a readable .bin file. ::) I thought that this may be of use to a couple of folks here, based on posts in the previous pages.

Now if I could just figure out how to get in via bootmode and write a copy of my primary .bin over this...


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: TCSTigersClaw on November 22, 2013, 12:26:07 AM
This revo read allows you to read Revoed cars through OBD ?

Anyway you can read Revo in boot mode just fine.Some important maps are just in different places more than once


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: Mo Arif on September 08, 2014, 11:45:42 AM
Sorry to bump an old thread but I'm experiencing the same thing with the same ECU / part no. did the OP or someone else manage to figure out how to get it in to boot mode


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: overclockedpc on August 23, 2015, 05:49:03 PM
Saw this picture somewhere.... could this be right? I've never seen jumping pins on the flash with a resistor before, it's always been a single pin to ground.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: ddillenger on August 23, 2015, 11:25:41 PM
Saw this picture somewhere.... could this be right? I've never seen jumping pins on the flash with a resistor before, it's always been a single pin to ground.

Methinks you should ohm that pin...



Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: overspeed on August 24, 2015, 07:03:15 AM
Never used, but i guess it´s Ok


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: overclockedpc on August 28, 2015, 12:14:36 AM
Just confirmed that the above photo method does work. A 10k resistor shorting the two pins of the flash chip will enable boot mode. The resistor must stay in place during the entire process.

The easiest way is to probably wire a switch and a 10k resistor and solder it in place for future use.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: turtlemann14 on January 04, 2019, 03:32:40 PM
can someone explain to me why we use pin 24(QD4 listed as a input/output) and 32(ground) with a resistor on that chip to boot mode it rather than the 44(RESET#) pin

data sheet for AM29F800BB-70SI
https://html.alldatasheet.com/html-pdf/55524/AMD/AM29F800BB-70SI/290/5/AM29F800BB-70SI.html

page 5 has pinout
page 8 has information on reset.


Title: Re: Boot mode not possible on ME7.5 (Infineon CPU)?
Post by: nyet on January 04, 2019, 04:07:06 PM
can someone explain to me why we use pin 24(QD4 listed as a input/output) and 32(ground) with a resistor on that chip to boot mode it rather than the 44(RESET#) pin

data sheet for AM29F800BB-70SI
https://html.alldatasheet.com/html-pdf/55524/AMD/AM29F800BB-70SI/290/5/AM29F800BB-70SI.html

page 5 has pinout
page 8 has information on reset.


Resetting the flash chip has nothing to do with bootmode.