Pages: 1 2 [3] 4 5 6
Author Topic: Boot mode not possible on ME7.5 (Infineon CPU)?  (Read 38276 times)
Nottingham
Full Member
***

Karma: +12/-1
Offline Offline

Posts: 204


« Reply #30 on: March 03, 2012, 06:28:03 AM »

If I turn on the voltage for both pin 3 and 62 at the same while the boot pin is grounded, the ECU will boot in normal mode.

If voltage is turned on for pin 3 (while pin 62 already powered) and the boot pin is grounded, the ECU boots up but is not able to connect in normal or boot mode (with any software).
Logged
ArgDub
Full Member
***

Karma: +57/-1
Offline Offline

Posts: 202


« Reply #31 on: March 03, 2012, 07:24:11 AM »

Seems P0L.4 is not at low level when you feed uP with power. What pin are you using as bootpin? Can you solder a wire directly to uP bootpin (PL0.4)?

 
Logged
Nottingham
Full Member
***

Karma: +12/-1
Offline Offline

Posts: 204


« Reply #32 on: March 03, 2012, 08:39:51 AM »

I will try using P.0L4 pin directly thru 8k resistor next time.
If that does not work I will try without the resistor.
Logged
Nottingham
Full Member
***

Karma: +12/-1
Offline Offline

Posts: 204


« Reply #33 on: March 06, 2012, 09:40:29 AM »

God damn it.

There is nothing extra between the C167 P.0L4 pin and the usual boot pin.

MPPS V12 -> cannot connect in boot mode.
Galletto -> cannot connect in boot mode.

Tried the specified 8k resistor too.
Logged
pvl
Sr. Member
****

Karma: +31/-0
Offline Offline

Posts: 350


« Reply #34 on: March 06, 2012, 09:52:09 AM »

Hi,

Did you try normal mode, in MPPS ? Thus no bootmode, but straight reading ?

That must work... 

On the bench and in the car. Hope you can try this out, and report back please.

PvL
Logged
Nottingham
Full Member
***

Karma: +12/-1
Offline Offline

Posts: 204


« Reply #35 on: March 06, 2012, 10:33:27 AM »

In normal mode MPPS returns "Error reading ECU" just like I expected.
It reads the ECU information correctly but cannot read the flash contents.

This is not a surprise, but the lack of boot mode is.
The CPU is not working as the datasheet specifies (BSL activation method).

GQ-4X will be the next step.
Logged
professor
Sr. Member
****

Karma: +23/-0
Offline Offline

Posts: 408



« Reply #36 on: March 06, 2012, 11:15:56 AM »

Always read the updates on this topic.
You ll desolder the eeprom and flash? Or read them on board?

Keep trying i wish you to solve the problem.
Logged

Seat Ibiza MK4 Cupra 1.8t 20V, stg3.
"Those 1.8T 20V machines are really tough" ©
pvl
Sr. Member
****

Karma: +31/-0
Offline Offline

Posts: 350


« Reply #37 on: March 06, 2012, 01:25:04 PM »

Hi,

MOST amazing...  Stunned by the problems, reading this damn ecu Sad

I also have a GQ-4X, but never had to use it for v.a.g. ecu's. This one
is a special one. You're sure there isn't a tune in already ? As that could
prevent this reading-out stuff. Desoldering the flash and the eeprom
will tell the tale Smiley

Please keep us informed about this matter.

Thanks,

PvL
Logged
Nottingham
Full Member
***

Karma: +12/-1
Offline Offline

Posts: 204


« Reply #38 on: March 07, 2012, 06:06:59 AM »

Did some reading on the full version of Siemens C167 datasheet.

There are other conditions that must be met in order to launch the BSL mode (properly).

The CPU has a "Special Operations Mode" (SMOD) which is controlled via P0L.2, P0L.3, P0L.4, P0L.5.
During hardware reset the CPU monitors signal levels on these pins (HI/LO).

For normal start mode all of the signals should be set HI during hardware reset:

Code:
P0L.2 = 1 (High)
P0L.3 = 1 (High)
P0L.4 = 1 (High) - a.k.a "the boot pin"
P0L.5 = 1 (High)

For SBL mode the signals should be set as follows (exactly what has been done during all these years):

Code:
P0L.2 = 1 (High)
P0L.3 = 1 (High)
P0L.4 = 0 (Low) - a.k.a "the boot pin"
P0L.5 = 1 (High)

The CPU sees signal being low if P0L.x -> Vss = 8k ohms (lower seems to work too).

However these two modes (normal & SBL) are the only modes that the CPU supports.
Any other P0L.2 - P0L.5 combinations can cause "undefined behaviour and should not be used" (according to the datasheet).

I made some measurements directly from the pins of the CPU and everything looks fine.
In power down mode the CPU is strapped to start in normal mode (P0L.2-5 are set to high; 4.6M - Vss).
Since this is obviously the case during power up I checked if altering the resistance between P0L.4 and Vss also alters the resistance on any other P0L.x pins, i.e pulls the low: -> Nope.

After this one was a dead-end I started tracking the pcb traces to see if there is any component which could pull any of P0L.2, P0L.3, P0L.5 signals low in case P0L.4 is being pulled low. The only chip on the PCB which has connection to all of the P0L.x signals (besides the C167 and AM29F800 flash) is the Bosch 30380 IC. This chip also has some kind of reset controlling feature for the CPU so it might well be behind all of the hassle.

Can anyone check the codes written on Bosch 30380 IC from a ECU with boot mode working properly?
Logged
rajivc666
Full Member
***

Karma: +18/-2
Offline Offline

Posts: 127



« Reply #39 on: March 07, 2012, 07:33:30 AM »

I can totally understand your plight as I had fried my 06A906032sg while putting it in bootmode for the first time. I remember doing all this you have done. well the pin P0L.4 is connected to a total of three other chips besides c167.AM29F800 and 2 other ,one chip on to the left of the AM29F800 when looking from the direction of AM29F800 and one on the other side of the board just below the AM29F800. Finally I gave up and bought an ecu off ebay for 40 pounds of the same engine code as mine (aum) an 06A906032hj.  Many are available , search using either 06A906032 or 06A 906 032. I dumped my 06A906032sg eeprom into the new ecu using Argdub's ME7_95040 and flashed the stock 06A906032hj code with nefmoto (had to do this as the car was not starting) and was good to go. Hope it helps.
Logged
pvl
Sr. Member
****

Karma: +31/-0
Offline Offline

Posts: 350


« Reply #40 on: March 27, 2012, 06:03:35 PM »

Hi Nottingham,

About that ecu you have...  06A906032RP ...  I might have an interesting piece of info about it.

Did you already desoldered the flashrom, and read it out via the GQ ?  Ifnot, it might not be needed
to check one thing. I have a UK-mate that wanted to help a friend with his S3 to tune it. I helped
him out via teamviewer-session and via mpps we where able to read the thing, like normal. Well
the thing really wanted 13.5 volts to get a stable read, and the dashfuse pulled. Then we tried to
write the tune to it. That was a no-go. Then i looked to the read-out code. And i saw : REVO (C).

It was a 'reverted to stock' demotune. What the buggers of Revo do (and perhaps also APR) is blocking
ALL write-options, via OBD AND bootmode. Even when the ecu is pulled you can't communicate via
K-line to get some diags going via vagcom !!! The ecu is not findable !  (on the bench, via benchflashlead).

We tried bootmode, with nefmoto and mpps : no go.  So therefore i suspect you have a reverted trial
in yours. And user 'professor' might be having the same issue !!.

My friend's brother that works @ a revo-dealer, told him that they block the bootmode and only their
tool is able to revert it back to real original stock back. So that might be your case.

You can try it out, reconnecting the ecu to the car, undoing the dashfuse (clocks go numb), and be sure you
have 13.5 volts reading in the lower left corner of mpps screen.

Then all should be fine to read-out. 

Would be nice if you could tell us forumpeeps if you succeeded. 
Ifnot, try it with dashfuse in place. But one thing is really needed : proper battery+tricklecharger power !! 

Not only the flashrom is modified b.t.w.  Also the e2p 95040 immo-chip. Therefore it's such a nightmare
without solderingtools or Reveo themselves cleaning up their mess, to program a reverted or revo tuned
ecu.

Cheers,

PvL
Logged
kls
Full Member
***

Karma: +12/-0
Offline Offline

Posts: 97


« Reply #41 on: March 27, 2012, 10:29:47 PM »

If bootmode is built into the processor itself then no changes to the flash or eeprom will prevent it from operating.
Logged
pvl
Sr. Member
****

Karma: +31/-0
Offline Offline

Posts: 350


« Reply #42 on: March 28, 2012, 02:06:34 AM »

Hopefully, like the stated S3 in previous message from me, the car is readable when the ecu is in the car.
By afterwards comparing the read-out to the original file (if available on the net) it becomes clear that
it has modified software inside.

@ KLS:  it is theorethically very nice to post info, but in reality things may differ a bit. Let's hope Nottingham
is able to read it out in his car like we did with the audi S3, and show the same we encountered.

If you have a alternative method to bypass this REVO protection against bootmode (and perhaps APR uses the
same way), you are welcome to say so.

Oh and another thing : NO communication whatsoever was possible when the ecu was taken out of the
car and putted on the workbench, and hooked-up via a benchflash lead. It was playing 'dead' like o.p. Nottingham
and forummember 'professor' have encountered.

But once placed-back in the car, all was normally working ?!?!?

B.T.W. if other forummembers have a non-soldering solution for this, do chime-in please. All help is welcome.

PvL
Logged
professor
Sr. Member
****

Karma: +23/-0
Offline Offline

Posts: 408



« Reply #43 on: March 28, 2012, 02:20:30 AM »

Read & flash eeprom and flash memory while soldered in the board isnt possible via clips and universal programmer?
Logged

Seat Ibiza MK4 Cupra 1.8t 20V, stg3.
"Those 1.8T 20V machines are really tough" ©
sn00k
Sr. Member
****

Karma: +58/-2
Offline Offline

Posts: 277


« Reply #44 on: March 28, 2012, 06:21:51 AM »

If bootmode is built into the processor itself then no changes to the flash or eeprom will prevent it from operating.

correct, thats all there is too it.. there is no "MAGIC super-protection" preventing this, it is just not possible tp prevent.
find/write an own bootloader that dumps the contents of the EEPROM and flash into 2 files on the computer, NO other code is run but your own.. surely the cpu is set in bootmode, but the tools you are using are specifically blocked.(galetto etc).

the only way to disable bootmode is to desolder the cpu, trash it, order a new cpu, program it with different instructions and solder it in place, and no need to tell you this has NOT been done to these ECUs.

what IS possible is a hardware scrambler solderd between the flash/eeprom and the chip, but you should be able to identify this one pretty easy just by looking at it.. im not aware of any chips with built in scrambler.. yet.. but you would easily see if the chips have been desolderd/swapped or not.

the flash and eeprom chips, are them the same sizes as the oem chips? i remember a protection beeing written for earlier bosch ecus, which filled the normal prom with crap, like "REVO REVO REVO..." and then after the normal code-space the new code was placed.. with a simple remap for the ecu to start reading at the second place.. the ecu does support larger flash/proms with the same pinout.. just a thought.

keep trying, im sure you will figure it out eventually =)
would love to get my hands on one of these ecus myself for some testing =)
« Last Edit: March 28, 2012, 06:38:49 AM by sn00k » Logged
Pages: 1 2 [3] 4 5 6
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.023 seconds with 17 queries. (Pretty URLs adds 0s, 0q)