tonyM
Newbie
Karma: +2/-0
 Offline
Posts: 10
|
 |
« on: January 30, 2011, 10:17:04 AM »
|
|
|
Hello everybody!
This is my first post in this forum.
I successfuly read VW Simos2 ECU (06A906019BQ_5WP4441-02, processor C167CR_LM, flash AM29F200BB) with Galetto1260 through boot mode. There isn't setting for that ECU, and I used the mentioned below:
- with ME 7.1.5 29F400BB setting, dump is 512KB with 2 equal parts of 256KB.
- with ME 7.5.5 29F800BB setting, dump is 1024KB with 4 equal parts of 256KB.
Writing isn't possible.
The ECU flash was also read with Minimon (tool for C16x processors) through K-line.
So, I read the address space from 080000 to 0BFFFF, and the result is axactly the same as Galetto output. Erasing/writing isn't possible.
When the dumps from Galetto/Minimon are loaded in Galetto, proper info is displayed:
Bytes: 3FFFF
Checksum: E378
Marca: Siemens Simos VW AUDI
Num. HW: 5WP4441-
Num. SW: DAT6577295480-
(For original flash dump of this ECU, checksum must be 7045)
Could someone tell me the proper address spaces for external flash in that configuration (SAK-C167CR-LM) for Minimon? I suppose they are the same for all ECUs with C167 processor. And if possible, ready-to-use driver for reading/writing (i.e. C167CR_AM29F200BB.ini).
Want to ask: If I desolder the flash chip and read it with eeprom programmer, will the dump be the same as those from Galetto/Minimon? I have a dump for this ECU (downloaded, mentioned as original), but different if hex-compared. How to know did Galetto/Minimon dumps are OK?
Finally, I want to use a tested method for reading/writing the flash of this ECU without desoldering.
And I'm waiting your advices.
Best regards!
|
|
|
|
« Last Edit: February 13, 2011, 01:11:37 PM by tonyM »
|
Logged
|
|
|
|
Tony@NefMoto
Administrator
Hero Member
Karma: +132/-4
Offline
Posts: 1389
2001.5 Audi S4 Stage 3
|
|
« Reply #1 on: February 02, 2011, 03:35:04 PM »
|
|
|
If when you read you are getting repeats of the data every 256KB, then I would assume that your flash memory size is only 256KB. All ME7 ECUs I have seen map the address lines to the flash memory so that the memory just repeats again if you read at too high of an address.
I would assume that the flash memory is located at 0x8000000 because that is where it is located in the ME7. If you really want to know, you need to trace the address lines between the processor and the flash memory.
|
|
|
|
|
Logged
|
|
|
|
tonyM
Newbie
Karma: +2/-0
Offline
Posts: 10
|
|
« Reply #2 on: February 13, 2011, 01:10:54 PM »
|
|
|
Tony, thank you for the .ini file for Minimimon. But I still can't get it to write/erase the flash. Reading is OK and goes without problems. What is the problem? May be the type of processor: C167CR-LM...  |
|
|
|
|
Logged
|
|
|
|
Tony@NefMoto
Administrator
Hero Member
Karma: +132/-4
Offline
Posts: 1389
2001.5 Audi S4 Stage 3
|
|
« Reply #3 on: February 13, 2011, 03:26:16 PM »
|
|
|
Do you have the correct memory driver loaded?
Reading is easy because it doesn't need any sort of driver. For writing and erasing you need a driver for the specific flash chip.
|
|
|
|
|
Logged
|
|
|
|
tonyM
Newbie
Karma: +2/-0
Offline
Posts: 10
|
|
« Reply #4 on: February 13, 2011, 03:53:20 PM »
|
|
|
The flash chip is different: it is AM29F200BB.
I loaded the correct driver (A29F200B.hex), but may be the other settings in the .ini file for this flash chip are not correct.
Could you help me to sort this out?
|
|
|
|
|
Logged
|
|
|
|
Tony@NefMoto
Administrator
Hero Member
Karma: +132/-4
Offline
Posts: 1389
2001.5 Audi S4 Stage 3
|
|
« Reply #5 on: February 13, 2011, 04:13:18 PM »
|
|
|
Post your ini file and I will see if I can see what may be wrong.
|
|
|
|
|
Logged
|
|
|
|
tonyM
Newbie
Karma: +2/-0
Offline
Posts: 10
|
|
« Reply #6 on: February 13, 2011, 04:36:14 PM »
|
|
|
Here it is:
|
|
|
|
|
Logged
|
|
|
|
Tony@NefMoto
Administrator
Hero Member
Karma: +132/-4
Offline
Posts: 1389
2001.5 Audi S4 Stage 3
|
|
« Reply #7 on: February 16, 2011, 08:12:35 PM »
|
|
|
It looks like you have the external flash configured properly. Do you get any error messages when trying to write or erase?
And if I recall correctly with MiniMon you need to make sure you are pressing the flash program button and not just the write memory button.
|
|
|
|
|
Logged
|
|
|
|
tonyM
Newbie
Karma: +2/-0
Offline
Posts: 10
|
|
« Reply #8 on: February 17, 2011, 11:55:24 AM »
|
|
|
The error messages are:
1. "Sector not successfuly erased", when I try to erase the flash.
2. If I load a modified file and press the press "Download selection to target" button, the error appears at first different byte, and the conection with target is lost.
I think, that I have to know the proper initialisation values for SYSCON, BUSCON0, BUSCON1, ADDRSEL1, BUSCON2, ADDRSEL2 in order to activate the write/erase. At this moment I use the default ones, provided from Minimon when target C167CR is selected.
If it will help, after establishing a connection, the reset value of the RP0H register is 00BB.
According to user manual of C167CR, this value: 0000-0000-1011-1011, means that: CLKCFG=101 (Fcpu=2xFosc), SALSEL=11 (2-bit segment address- A17...A16), CSSEL=01 (2 CS lines- CS1...CS0), WRC=1 (Pins WR and BHE operate as WR and BHE signals).
|
|
|
|
« Last Edit: February 17, 2011, 12:37:44 PM by tonyM »
|
Logged
|
|
|
|
Tony@NefMoto
Administrator
Hero Member
Karma: +132/-4
Offline
Posts: 1389
2001.5 Audi S4 Stage 3
|
|
« Reply #9 on: February 17, 2011, 12:56:51 PM »
|
|
|
Here are my old minimon settings which I posted in the other thread, and I think you already have.
I noticed that the Driver.BufferAddress in your flash driver config was different from mine, but that is all I could see that may be wrong.
When you are erasing, are you erasing entire sectors? I believe erasing may fail if you don't have entire sectors selected.
"Download selection to target" won't work for programming flash memory, because it only tries to write the data, but doesn't do the flash programming protocol. You need to click the "Intelligent program of selection into flash" for it do use the flash programming protocol to program the flash chip.
|
|
|
|
|
Logged
|
|
|
|
tonyM
Newbie
Karma: +2/-0
Offline
Posts: 10
|
|
« Reply #10 on: February 19, 2011, 07:12:28 AM »
|
|
|
?Any possibility for mistakes in the driver for the flash A29F200BB?
Take a look at the file A29f200B.a66 in C:\Program Files\MiniMon\Driver\A29f200b and at the Command Sequences Definitions (especially- bus cycles addresses) in AM29F200 datasheet.
I don't know what the situation in the A29f200B.hex is (Minimon has Diasassemble function but I'm not familiar in C167 programing).
What do you think about that?
|
|
|
|
« Last Edit: February 19, 2011, 07:56:48 AM by tonyM »
|
Logged
|
|
|
|
Tony@NefMoto
Administrator
Hero Member
Karma: +132/-4
Offline
Posts: 1389
2001.5 Audi S4 Stage 3
|
|
« Reply #11 on: February 22, 2011, 09:08:40 PM »
|
|
|
If I recall correctly, when I wrote my 29F800 driver I based it on the 29F400 driver. I believe there was one or two bugs in the 29F400 driver, but I think they were only related to writing to the higher sectors or something.
Did you try the "Intelligent program of selection into flash" button?
|
|
|
|
|
Logged
|
|
|
|
tonyM
Newbie
Karma: +2/-0
Offline
Posts: 10
|
|
« Reply #12 on: September 01, 2012, 12:30:05 PM »
|
|
|
I found useful info rearding discussed problem here: http://www.keil.com/forum/20221/To prove this, on a dissasembled ECU, I routed the data lines between C167-proc and AMD-flash. Here is the result: | C167CR-LM | AMD29F200BB | | AD0 | DQ4 | | AD1 | DQ12 | | AD2 | DQ5 | | AD3 | DQ13 | | AD4 | DQ6 | | AD5 | DQ14 | | AD6 | DQ7 | | AD7 | DQ15 | | AD8 | DQ11 | | AD9 | DQ3 | | AD10 | DQ10 | | AD11 | DQ2 | | AD12 | DQ9 | | AD13 | DQ1 | | AD14 | DQ8 | | AD15 | DQ0 |
So, the problem with write/erase fails is that the data lines are crossed (for routing simplification): when the C167 "wants" to write the "sequences" (see the AMD datasheet), the memory doesen't see the right values. Actually, this problem is well known in Siemens automotive ECU units. For example, in some cases you must write "44h" on the proc side, if you want the memory to see part of the unlock sequence "A0h". So, I have to rewrite (and recompile) the minimon driver in order to correct the memory patterns. Progs as WinOls and ECM2001 have integated option to code/decode dumps BIN<->SIE, due to swapped data lines. For comparision, find two attached files: one is in-circuit read with Minimon, the other is read by eeprom programmer (flash chip desoldered). Could someone help me to write a new driver for AMD29F200BB and AMD29F400BB, which will work in the case with swapped data lines? Thanks. |
|
|
|
|
Logged
|
|
|
|
wesselh93
Newbie
Karma: +2/-1
Offline
Posts: 23
|
|
« Reply #13 on: August 19, 2018, 01:40:41 PM »
|
|
|
I found useful info rearding discussed problem here: http://www.keil.com/forum/20221/To prove this, on a dissasembled ECU, I routed the data lines between C167-proc and AMD-flash. Here is the result: | C167CR-LM | AMD29F200BB | | AD0 | DQ4 | | AD1 | DQ12 | | AD2 | DQ5 | | AD3 | DQ13 | | AD4 | DQ6 | | AD5 | DQ14 | | AD6 | DQ7 | | AD7 | DQ15 | | AD8 | DQ11 | | AD9 | DQ3 | | AD10 | DQ10 | | AD11 | DQ2 | | AD12 | DQ9 | | AD13 | DQ1 | | AD14 | DQ8 | | AD15 | DQ0 |
So, the problem with write/erase fails is that the data lines are crossed (for routing simplification): when the C167 "wants" to write the "sequences" (see the AMD datasheet), the memory doesen't see the right values. Actually, this problem is well known in Siemens automotive ECU units. For example, in some cases you must write "44h" on the proc side, if you want the memory to see part of the unlock sequence "A0h". So, I have to rewrite (and recompile) the minimon driver in order to correct the memory patterns. Progs as WinOls and ECM2001 have integated option to code/decode dumps BIN<->SIE, due to swapped data lines.For comparision, find two attached files: one is in-circuit read with Minimon, the other is read by eeprom programmer (flash chip desoldered). Could someone help me to write a new driver for AMD29F200BB and AMD29F400BB, which will work in the case with swapped data lines? Thanks. This maybe is a really old thread, but the above comment just made my day a lot easier! |
|
|
|
|
Logged
|
|
|
|
|
