Pages: [1] 2 3
Author Topic: Difficulty reading flash on Passat 1.8T B5  (Read 31642 times)
bodhi
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 13


« on: January 31, 2011, 08:19:45 AM »

I've been having trouble getting the Flasher software working with my car; thought I'd ask and see if anyone has some tips

- VW Passat 1.8T B5 (Euro), APU Engine
- ECU: 4B0906018AA/0261206449
- Using either genuine HEX-CAN VCDS cable (set to dumb mode), or clone from easybid2000
- Trying with Nefmoto software since some time back with 1.5.x.x; currently trying with 1.6.1.0
- Running inside Virtualbox

Essentially, I'm unable to reliably read from the ECU, and am currently thinking I'm being an idiot and not finding the correct fuse to disable the instrument cluster

- I can reliably connect to the ECU with the ignition powered off (but can't read then due to preconditions not being met)
- I can occasionally connect to the ECU with the ignition powered on; then, only at the slow baud rate, and with slow init (very hit-and-miss as to when it'll connect correctly)
- All VCDS functions work as expected

I've gone over both the Bentley and Haynes circuit diagrams, and pulled what could be the relevant fuses (either 5 or 15), with no discernable difference.  Same effect is seen with car on or off charger.

I'll pull some logs later on today, but maybe somebody has a pointer to a fuse/relay I'm missing due to short-sightedness?

(as a side note, I've been able to successfully pull an image via Galletto, in-car).
« Last Edit: January 31, 2011, 10:47:40 AM by bodhi » Logged
phila_dot
Hero Member
*****

Karma: +173/-11
Offline Offline

Posts: 1709


« Reply #1 on: January 31, 2011, 09:20:32 AM »

Pulling the fuses is only for power conservation. The ignition needs to be on (not started just power on) to power the ECU. Are you using the correct memory layout? Are the buttons activated on the flashing software? Post logs and I am sure Tony or some of the more experienced members will be able to help.
Logged
bodhi
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 13


« Reply #2 on: January 31, 2011, 10:54:08 AM »

Are you using the correct memory layout? Are the buttons activated on the flashing software?

Yep, either the 29F800BB or 29F800BT layouts will validate correctly.  Obviously haven't got as far as trying to write yet, but I'm aware that both of those memory layouts will "verify" OK, but only one will be suitable come write-time (as per http://www.nefariousmotorsports.com/forum/index.php?topic=258.0title=)

Buttons are available once I can connect to the ECU; it's getting connected reliably that's the issue.

Logs coming up later, once I get home.
Logged
bodhi
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 13


« Reply #3 on: January 31, 2011, 11:40:19 AM »

Log files attached; one for connecting successfully with the ignition off (albeit unable to validate memory layout, or read flash, as would be expected), and one with the ignition on (unable to connect at all, with any combo of baud or init speed).

My comments begin with ###.

Any DTCs appear to be turning up as a result of me pulling various fuses along the way; they don't reappear minus my clumsy fiddling.
Logged
bodhi
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 13


« Reply #4 on: January 31, 2011, 01:10:38 PM »

For good measure, here's a log I found of when I was able to successfully connect to the ECU (ignition on etc.), validate the memory layout, and start reading the flash.  I didn't believe it at the time, so cut the session short to see if I'd be able to reconnect, but no dice.
Logged
setzi62
Full Member
***

Karma: +142/-0
Offline Offline

Posts: 249


« Reply #5 on: February 01, 2011, 11:48:11 AM »

Essentially, I'm unable to reliably read from the ECU,  ...
- I can reliably connect to the ECU with the ignition powered off (but can't read then due to preconditions not being met)
- I can occasionally connect to the ECU with the ignition powered on; then, only at the slow baud rate, and with slow init (very hit-and-miss as to when it'll connect correctly)
- All VCDS functions work as expected
Wow, I thought that never somebody would show up with similar problem!!
From your desription it sounds to be related to what I am facing.  I'm fighting with
KWP2000 communication problems, also in a Passat B5 Euro, already a very long time and
never found out what is causing this. This is driving me really mad  :'(.

I see the following:
Ignition off (the ECU keeps running for 10-15 minutes after turning ignition off):
- Slow init and fast init work fine, communication with KWP2000 protocol is perfectly. I can
  send and receive small and big messages and also the comm session keeps active if I send
  at least each 5 seconds a message.
From this result I think I can exclude any problem with the used PC and the interface cable
or the software.

Ignition On:
1) VCDS functionality is working fine (using KWP1281 protocol).
2) Fast init does NOT work, NEVER got a response to the startCommunication message.
    (with a patched image I could show at least that the fast init pulse was recognized, so it's
    not the 25ms timing)
3) Slow init works fine, also communication works fine at first.
4) Communication drops "randomly": suddenly for the next request no response is received
    (not a single byte), also for further requests no response, until the session is started
    again with slow init.
5) I never faced checksum errors or undecodeable responses, only this stop of
   communication from ECU's side.
   The problem appears with different interface cables and when using different PC's, so I
   again exclude an erroneous interface (also, the comm is perfect when ign off!).
6) I found that KWP2000 communication was stable when using response messages of
    only <=32 bytes and when keeping the gap between response and next request shorter
    that roughly 250ms (using the 5 seconds timeout was definitely not working!).
7) After starting a programming session, I still had at first this unstable communication.
   But after letting the session time out and then reconnect to the programming
   session/ram system, I have stable KWP2000 communication with 5 second timeout and
   no errors (as with ignition off).

When running a simulation, I could not find any hint that the ECU would stop actively
communication in the way it is seen in the car (but simulation is without the incoming CAN
messages from other units).

I can currently think of two things:
a) The ECU receives messages via CAN which cause this problem when ignition is on. This
    would mean it is an intentional behaviour of the ECU (no idea what for besides driving
    people mad  Angry)??
b) The K-line is disturbed by other units on the line which are powered off when ignition is
    turned off. (but why are they not disturbing if the ECU switched to programming
    session?)

Is this all a bug or intention???
Anyway, I'll keep on searching to find the root cause of this behaviour and would be glad to
hear also if you have a "break-through" with this strange communication problem.
« Last Edit: March 30, 2011, 11:42:58 AM by Tony@NefMoto » Logged
Tony@NefMoto
Administrator
Hero Member
*****

Karma: +132/-4
Offline Offline

Posts: 1389


2001.5 Audi S4 Stage 3


« Reply #6 on: February 02, 2011, 03:27:27 PM »

Thanks for the log files. Here are some of my thoughts...

I have been told by many professionals that deal with VAG ECUs to not bother with fast init, because it is not properly supported on most VAG ECUs. They recommend always using slow init.

I should probably try doing a slow init to address 0x11 after multiple failures to address 0x01. Currently I only try address 0x11 after getting a successful response to address 0x01. This could help...

Some of the VAG flashing documents recommend broadcasting the "Mute" command before running the flashing process. This command is meant to tell other modules in the car to stop transmitting so they don't interrupt the flashing process. None of the ECUs I have looked at though handle the "Mute" command though, so I haven't implemented it.
Logged

Remember you have to log in if you want to see the file attachments!
Info or questions, please add to the wiki: http://www.nefariousmotorsports.com/wiki
Follow NefMoto developments on Twitter: http://twitter.com/nefmoto
setzi62
Full Member
***

Karma: +142/-0
Offline Offline

Posts: 249


« Reply #7 on: February 03, 2011, 02:43:15 AM »

I have been told by many professionals that deal with VAG ECUs to not bother with fast init, because it is not properly supported on most VAG ECUs. They recommend always using slow init.

Some of the VAG flashing documents recommend broadcasting the "Mute" command before running the flashing process. This command is meant to tell other modules in the car to stop transmitting so they don't interrupt the flashing process. None of the ECUs I have looked at though handle the "Mute" command though, so I haven't implemented it.

On all ME7.1's and ME7.5's which I have looked at, the fast init was always implemented in
the code, and on all ecu's in the same way.  If fast init is not working it is most probably
due to incorrect timing of the tester (or it's something like the problem I face with
ignition on). The most crucial thing is the correct timing for the wakeup pulse before the
startComm message is sent. When I was testing fast init with a microcontroller (exact
timing), the wakeup worked fine.

This "mute" command sounds interesting. I would like to give it a try in my environment.
Can you provide more details, I never heard about this command before. Maybe I should
have seen it in some document already, but don't know where to look.
Logged
Tony@NefMoto
Administrator
Hero Member
*****

Karma: +132/-4
Offline Offline

Posts: 1389


2001.5 Audi S4 Stage 3


« Reply #8 on: February 03, 2011, 03:23:57 PM »

On all ME7.1's and ME7.5's which I have looked at, the fast init was always implemented in
the code, and on all ecu's in the same way.  If fast init is not working it is most probably
due to incorrect timing of the tester (or it's something like the problem I face with
ignition on). The most crucial thing is the correct timing for the wakeup pulse before the
startComm message is sent. When I was testing fast init with a microcontroller (exact
timing), the wakeup worked fine.

This "mute" command sounds interesting. I would like to give it a try in my environment.
Can you provide more details, I never heard about this command before. Maybe I should
have seen it in some document already, but don't know where to look.

The "mute" command is described in the document in this thread:
http://www.nefariousmotorsports.com/forum/index.php?topic=95.0title=

I found that fast init worked on the 2000 and 2001 Audi S4, but would not work on the 2002 S4. I verified all of the timings were accurate to the millisecond with a logic analyzer. The KWP2000 spec suggests that the fast init timings should be accepted plus or minus 1 or 2 milliseconds if I recall.

I also found that some ECUs had problems entering programming mode after a fast init, but with a slow init they happily entered programming mode. The ECU would seem to go into an infinite loop trying to enter programming mode with fast init.

One thing that may be related to this, is that with slow init the ECU specifies that it doesn't want the source and destination address information in the message headers. But if you use fast init, then the ECU specifies that it does want the source and destination information in the message headers. So the communication protocol is actually more efficient if you use slow init, because then you can save two bytes in the header of every message.
Logged

Remember you have to log in if you want to see the file attachments!
Info or questions, please add to the wiki: http://www.nefariousmotorsports.com/wiki
Follow NefMoto developments on Twitter: http://twitter.com/nefmoto
setzi62
Full Member
***

Karma: +142/-0
Offline Offline

Posts: 249


« Reply #9 on: February 04, 2011, 06:20:51 AM »

Tony, thank you for the link to the document. Now I remember that I already had a
look at it some time ago. But seems like the "mute" command is used only when
flashing ECUs via CAN/TP2.0.

What you found about the fast init is also very interesting.  Which image was the 2002 S4
that does not allow the fast init?  I have a 2002 VW image with fast init also not working
with ignition on, but it is fine after turning off. In simulation, fast init works always fine
and the code shows no reason why it should not work always.
I'm going mad to find out what the hell could prevent using reliably the fast init!

Regarding the infinite loop on turning on programming mode: I saw this happen when
trying to start a programming session while ignition is turned off.  The ecu was sending
responsePending endlessly (a bug in the ecu's communication software).
Could it be you had same conditions when that happened after fastinit?
Logged
Tony@NefMoto
Administrator
Hero Member
*****

Karma: +132/-4
Offline Offline

Posts: 1389


2001.5 Audi S4 Stage 3


« Reply #10 on: February 08, 2011, 01:39:18 PM »

I wasn't able to start fast init with the 2002 B5 Audi S4 8D0907551T.

The infinite loops I saw were with "ConditionsNotCorrectOrSequenceError" responses I believe. I can't remember the exact situation that caused this, but I think it was more likely to occur with the 2000 B5 Audi S4 8D0907551A.
Logged

Remember you have to log in if you want to see the file attachments!
Info or questions, please add to the wiki: http://www.nefariousmotorsports.com/wiki
Follow NefMoto developments on Twitter: http://twitter.com/nefmoto
setzi62
Full Member
***

Karma: +142/-0
Offline Offline

Posts: 249


« Reply #11 on: March 29, 2011, 10:03:45 AM »

Essentially, I'm unable to reliably read from the ECU,  ...
- I can reliably connect to the ECU with the ignition powered off (but can't read then due to preconditions not being met)
- I can occasionally connect to the ECU with the ignition powered on; then, only at the slow baud rate, and with slow init (very hit-and-miss as to when it'll connect correctly)
- All VCDS functions work as expected
I'm fighting with KWP2000 communication problems, also in a Passat B5 Euro, already a
very long time and never found out what is causing this. This is driving me really mad  Cry.
...
I can currently think of two things:
a) ...
b) The K-line is disturbed by other units on the line which are powered off when ignition is
    turned off. (but why are they not disturbing if the ECU switched to programming
    session?)

Just wanted to bring this up again, since I could fix the communication problems by installing
an extra wire from the ECU to the tester!
I installed a relay to be able to disconnect all controllers off the K-line except the ecu.
When I have only the ecu on the K-line, communication works perfect!  Even fast init is
possible without any problem  Cheesy Cheesy.
It must have been possibility b) from above, maybe I spend some time in future to find out
which module disturbs the K-line.

In  http://www.nefariousmotorsports.com/forum/index.php/topic,271.msg1510.html#msg1510, same thing was mentioned:
Spen,
very interesting that you can't use KWP over  OBD.  Have you tried Tony's software in your car?  Do you know why it doesn't work in car?  I've not looked at the wiring diagram yet, but is it due to the other modules on the Kline not liking KWP2000?

If so, I will run a cable straight from the ECU plug to the OBD socket, and have an isolation switch which disconnects everything from the Kline apart from the ECU and OBD socket.  That should work as that's how it is on the bench.  Pain in the arse having to bench flash each time.

Rick
Rick, did you give the extra wire a try?


Wow, finally I can start to test some things and take logs from the car this weekend  Smiley.
Thought this would never happen.
« Last Edit: June 07, 2011, 12:17:48 PM by Tony@NefMoto » Logged
Tony@NefMoto
Administrator
Hero Member
*****

Karma: +132/-4
Offline Offline

Posts: 1389


2001.5 Audi S4 Stage 3


« Reply #12 on: March 30, 2011, 12:08:00 PM »

Thanks for sharing what you found. I wonder if there is a special command that the NefMoto software needs to send to tell the other controllers to stay quiet. Maybe we could check what ECUx or VCDS due to start the connection.

I assume it is also possible that limiting the message size to 32 bytes, and adjusting the message timings could also resolve the issue.
Logged

Remember you have to log in if you want to see the file attachments!
Info or questions, please add to the wiki: http://www.nefariousmotorsports.com/wiki
Follow NefMoto developments on Twitter: http://twitter.com/nefmoto
Rick
Hero Member
*****

Karma: +63/-4
Offline Offline

Posts: 704


« Reply #13 on: March 31, 2011, 01:02:22 PM »

I could not establish any form of communication in car, slow or fast innit. 

I have now run another cable as described which isolates the ECU.  Result is perfect fast and slow communication all the time.  No idea what is causing the problem.

Rick
Logged
bodhi
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 13


« Reply #14 on: June 01, 2011, 06:25:02 PM »

I see you folks made some decent progress since I last checked in.  I'll pull out my Bentley manual over the weekend, and see if I can make a map of modules hanging on the k-line (given we're seeing the same issue on both US and EU models, the Bentley diagrams should include the right info nonetheless).
Logged
Pages: [1] 2 3
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.029 seconds with 17 queries. (Pretty URLs adds 0s, 0q)