Welcome to the North American Subaru Impreza Owners Club Tuesday September 30, 2014
Home Forums WikiNASIOC Products Store Modifications Upgrade Garage
NASIOC
Here you can view your subscribed threads, work with private messages and edit your profile and preferences Home Registration is free! Visit the NASIOC Store NASIOC Rules Search Find other members Frequently Asked Questions Calendar Archive NASIOC Upgrade Garage Logout
Go Back   NASIOC > NASIOC Technical > Engine Management & Tuning

Welcome to NASIOC - The world's largest online community for Subaru enthusiasts!
Welcome to the NASIOC.com Subaru forum.

You are currently viewing our forum as a guest, which gives you limited access to view most discussions and access our other features. By joining our community, free of charge, you will have access to post topics, communicate privately with other members (PM), respond to polls, upload content and access many other special features. Registration is free, fast and simple, so please join our community today!

If you have any problems with the registration process or your account login, please contact us.
* Registered users of the site do not see these ads.
Reply
 
Thread Tools Display Modes
Old 06-21-2011, 12:30 PM   #1
Franko
Scooby Newbie
 
Member#: 193628
Join Date: Nov 2008
Chapter/Region: E. Canada
Location: Canada
Vehicle:
2010 STI
SSM

Default How to Unbrick an ECU. Like A Boss!

A laptop crash half way through a reflash of my buddies 04 sti rendered the ecu useless. This event drove me to figure out how to recover a bricked ecu.

The forums can be confusing to read and understand and pictures of the rig built/hooked up are scarce. On top of that, tactrix doesn't offer the ecu recovery service anymore so I had to get right into it.

First of all, you need to be able to soldier or have a friend who can and is willing to help you out to build this thing.

The parts you will need..

Buy this.. DLP-USB232M from mouser.com

Click Here

The DLP has most of the circut built for you already so you dont need all kinds of parts, only a few.

Here is the pdf of the thing you need to build

Here is the DLP schematic (last page). Compare these two and you see that you only need a L1 Ferrite.. AKA a coil of wire for noise removal and you need a .01uf capacitor (reads 103 on it). They connect to EHR-5 pin 1.

VCC is usb voltage.. The down arrow in the shbootmode pdf is ground. The DLP needs to be self powered so you must make a connection on the pins to make it do that. Page 6 of this pdf will tell you how to do that. This is also where the vcc voltage is found.

Reset# goes to vcc
CTS#, DSR# and DCD# go to ground.

After that.. Pick up
Bread board
555 timer (radio shack)
a 47.5k resistor
2 1k resistors
and a 100nf capactor (has 104 on it)

Build the timer circuit using the same source for vcc and ground as your main circuit and that should make the nessicary 150 hz signal for the 'watch dog' signal.

Attach your circuit to the board as shown here..


p405 (pink) is VCC
p407 (purple) is the 150 hz 555 timer signal
p409 (orange) is TX
p411 (yellow) is RX
p413 (black) is ground.. this also goes to one side of the capacitor as shown.

After a lot of cursing you should have the following.









The ecu also needs to be powered up via a car battery or power supply. I powered up a lot of pins and when properly powered the ecu should draw around 400 ma of current.



Thick wires are 12v (incl black wire) and thin wires are ground. Hook up to power like so.. (this was an 04 ecu so check your own wiring diagram to see which ones need to be powered up on yours)



Now.. Tactrix's website tells you to use their application to recover the ecu.. It would not work for me. Some ppl can get it to work but with this setup I had to go a slightly different route.

Trying ecu flash generated this message:
[22:16:12.954] Using interface USB <-> Serial
[22:16:14.839] sending bit rate sync bytes...
[22:16:14.839] received bit rate adjust response
sending boot command
[22:16:15.370] received bit rate adjust response
sending boot command
[22:16:15.900] received bit rate adjust response
sending boot command
[22:16:16.431] received bit rate adjust response
sending boot command

etc.... it didnt work..

So go here.

Renesas Flash developer toolkit

Sign up and download the fdt application.

Run developer toolkit basic and search for your renesas ecu in the list.. this one was the 7055. Its written on top of the biggest chip on the ecu.



After that you will be here..



To load your tune (.hex file) into the application you must change the .hex extension to .bin. Before clicking 'program flash' its just like flashing the ecu in the car you must time the click the button a split second after you apply power to the ecu. If you succeed you will be rewarded with the following:

Clock Frequency (External) = 10.0000MHz, Clock Mode = 0, CKM = 4, and CKP = 2
Connecting to device 'SH7055F' on 'COM8'
Configuration
'BOOT Mode' connection - using emulated interface
Opening port 'COM8' ...
Loading Comms DLL
Loaded Comms DLL
Initiating BOOT SCI sequence
Attempting 9600
Received immediate response from device 0xAA
Using micro-Kernel 'CProgram Files (x86)RenesasFDT4.07kernelsProtB7055Renesas1_0_00uG en7055r.cde'
Downloading and verifying micro kernel...
Device is erasing...
Erase Timeout value set to 21 seconds
Erase Successful
micro-Kernel download successful
Sending inquiry for getting line size
Buffer size has been set to default (128 bytes)
Sending selection of device command
Selection of Device - Device selected, code 0405
Sending selection of clock mode
Sending selection of clock mode
Selection of Clock Mode - Clock selected, code 0
Changing baud rate to 38400 bps
Set baud rate value = 38400
Downloading main kernel 'CProgram Files (x86)RenesasFDT4.07kernelsProtB7055Renesas1_0_00Ge nm7055.cde'
Main kernel download complete...
Connection complete
Processing file CUsersFrankDesktop2004 STI LC+FFS cobb settings.bin
Loading image file 'CUsersFrankDesktop2004 STI LC+FFS cobb settings.bin'
Operation on User Flash
Downloaded the operation module
Writing image to device... [0x00000000 - 0x00000B7F]
Writing image to device... [0x00000F80 - 0x00001EFF]
Writing image to device... [0x00001F80 - 0x0005FE7F]
Writing image to device... [0x0005FE80 - 0x0007D97F]
Writing image to device... [0x0007E700 - 0x0007E77F]
Writing image to device... [0x0007FA80 - 0x0007FAFF]
Writing image to device... [0x0007FB80 - 0x0007FFFF]
Data programmed at the following positions
0x00000000 - 0x00000B7F Length 0x00000B80
0x00000F80 - 0x00001EFF Length 0x00000F80
0x00001F80 - 0x0005FE7F Length 0x0005DF00
0x0005FE80 - 0x0007D97F Length 0x0001DB00
0x0007E700 - 0x0007E77F Length 0x00000080
0x0007FA80 - 0x0007FAFF Length 0x00000080
0x0007FB80 - 0x0007FFFF Length 0x00000480
502.63 K programmed in 609 seconds
Image written to device
Disconnecting
Disconnected

Holy crap it worked! Remove the connections from the ecu and put it back in the car. Enjoy your non bricked ecu.

I'll add to this post if I left anything out.

If you need help building this rig or want me to try and unbrick your ecu for you just send me a pm and I will be happy to help you out!
* Registered users of the site do not see these ads.
Franko is offline   Reply With Quote
Old 06-21-2011, 12:47 PM   #2
biodude
Scooby Specialist
 
Member#: 271720
Join Date: Jan 2011
Chapter/Region: Tri-State
Location: NEPA
Default

Quote:
Originally Posted by Franko View Post
Holy crap it worked!
that was my favorite part.

nice write up. hope I never need it
biodude is offline   Reply With Quote
Old 06-21-2011, 03:06 PM   #3
wgr73
Scooby Specialist
 
Member#: 232458
Join Date: Dec 2009
Chapter/Region: SWIC
Location: Las Cruces, El Paso
Vehicle:
2008 STi (OBP)
CAMTuning.com

Default

Wow, that's awesome work Franko!!! This is going to save a lot of people who are component savvy some time and $$. Great work!
wgr73 is offline   Reply With Quote
Old 06-21-2011, 11:32 PM   #4
NSFW
Scooby Guru
 
Member#: 140444
Join Date: Feb 2007
Chapter/Region: NWIC
Location: Near Seattle, WA
Vehicle:
05 Stage Free LGT
ATP 3076, 6MT, AVO FMIC

Default

Bravo.
NSFW is offline   Reply With Quote
Old 06-22-2011, 11:45 AM   #5
Hyper
Scooby Guru
 
Member#: 15822
Join Date: Feb 2002
Location: MOCKBA
Vehicle:
1999 WRB GM6
2.12cc V9 Type RA

Default

too bad it doesn't work with 16bit ECUs
Hyper is online now   Reply With Quote
Old 06-23-2011, 07:40 AM   #6
jaxscuby
Sammo Hung
Moderator
 
Member#: 10613
Join Date: Sep 2001
Chapter/Region: South East
Location: S Ga / Hell Rock
Vehicle:
2002 USDM WRX
WRB

Default

nice job!

going to have build one of those myself.
so i can unbrick ecu's
jaxscuby is offline   Reply With Quote
Old 06-23-2011, 12:31 PM   #7
pet3r
NASIOC Supporter
 
Member#: 283134
Join Date: May 2011
Location: AZ
Vehicle:
2008 STi AW
550whp - 530wtq

Default

holy crap
pet3r is offline   Reply With Quote
Old 06-23-2011, 08:50 PM   #8
Franko
Scooby Newbie
 
Member#: 193628
Join Date: Nov 2008
Chapter/Region: E. Canada
Location: Canada
Vehicle:
2010 STI
SSM

Default

Quote:
Originally Posted by Hyper View Post
too bad it doesn't work with 16bit ECUs
Its depressing.. From what I can see the 16 bit ecus do not use the renesas chip. There is a way to do it, but i cant find much info on the subject.
Franko is offline   Reply With Quote
Old 06-23-2011, 11:15 PM   #9
jigga
Scooby Guru
 
Member#: 9960
Join Date: Sep 2001
Location: in bed...
Vehicle:
2002 Impreza WRX
WRBlue Perl

Default

Nice! Perhaps the contents of this thread should become a sticky?
jigga is offline   Reply With Quote
Old 06-24-2011, 01:48 AM   #10
340Duster
Scooby Specialist
 
Member#: 52314
Join Date: Jan 2004
Chapter/Region: South East
Location: Following the green weenie
Vehicle:
2002 PSM WRX 16G-XT
'13 500 Abarth

Default

This seems like an appropriate place to comment about the 16 bit ecu. I thought I bricked mine today as a loose USB port connection caused a flash to interrupt. Nothing would work and the car was stuck in test mode. For whatever reason, unhooking the negative battery cable for a few minutes and then trying it worked to flash it and get it running again.
340Duster is offline   Reply With Quote
Old 06-24-2011, 09:41 AM   #11
adrenalinejunkie
Scooby Newbie
 
Member#: 204728
Join Date: Mar 2009
Chapter/Region: MAIC
Location: NOVA
Vehicle:
2004 STI
Blue

Default

Wow Franko!! This is a great thread, and I wish more people would post like this. Thanks +1 for sticky. I think my newer ecu(replaced last year) just shat itself again.....
adrenalinejunkie is offline   Reply With Quote
Old 06-24-2011, 10:42 AM   #12
indytruckboy
Scooby Specialist
 
Member#: 192599
Join Date: Oct 2008
Chapter/Region: MAIC
Location: Reading, PA
Vehicle:
2004 STI
2007 Outback Wagon

Default

Amazing. I have this thread saved incase I ever brick my unit.
indytruckboy is offline   Reply With Quote
Old 06-24-2011, 01:39 PM   #13
ogboot
Scooby Specialist
 
Member#: 170906
Join Date: Feb 2008
Chapter/Region: South East
Vehicle:
2002 WRX
psm

Default

Quote:
Originally Posted by Franko View Post
Its depressing.. From what I can see the 16 bit ecus do not use the renesas chip. There is a way to do it, but i cant find much info on the subject.
For the love of all, please figure out the 16bit ECU too
ogboot is offline   Reply With Quote
Old 06-24-2011, 06:32 PM   #14
subsagrin
Scooby Specialist
 
Member#: 198721
Join Date: Dec 2008
Chapter/Region: MWSOC
Location: Chicago
Vehicle:
2006 Wrx st,
98 Rsti

Default

nice work congrats, have two bricked ecu, time to bring them back to live
Just like others notice, someone has to finish you work and find out how to do 16bit
subsagrin is offline   Reply With Quote
Old 06-24-2011, 06:35 PM   #15
Bishop
NASIOC Supporter
 
Member#: 59993
Join Date: Apr 2004
Chapter/Region: International
Location: WWAAYY west of the Mississippi
Vehicle:
Ass, grass or cash
no one rides for free!!

Default

Very nice! Sticky!!!!
Bishop is offline   Reply With Quote
Old 07-05-2011, 08:18 AM   #16
2bfi
Scooby Newbie
 
Member#: 265981
Join Date: Dec 2010
Vehicle:
2011 STi Sedan
Dark Gray

Default

Wow, this is great! What's the specs of the ferrite bead? Where did you get it?
2bfi is offline   Reply With Quote
Old 07-05-2011, 08:28 AM   #17
Bad Noodle
Scooby Specialist
 
Member#: 174442
Join Date: Mar 2008
Chapter/Region: Tri-State
Location: NNJ
Vehicle:
2007 SuperWagon
I don't spell well

Default

holy crap... you are awesome!
Bad Noodle is offline   Reply With Quote
Old 07-05-2011, 12:42 PM   #18
Hyper
Scooby Guru
 
Member#: 15822
Join Date: Feb 2002
Location: MOCKBA
Vehicle:
1999 WRB GM6
2.12cc V9 Type RA

Default

Quote:
Originally Posted by Franko View Post
Its depressing.. From what I can see the 16 bit ecus do not use the renesas chip. There is a way to do it, but i cant find much info on the subject.
I did a big reasearch a while ago and found all the chip specs, and even software and hardware that can be used to unbrick it, but those things cost a fortune...
if you are interested, I can email you all my info gathered on the subject, it might just take a while to recollect it in my memory and put it down on keyboard
Hyper is online now   Reply With Quote
Old 07-11-2011, 12:12 PM   #19
AB-737
Scooby Newbie
 
Member#: 236196
Join Date: Jan 2010
Default

I'm trying to build this and I'm a bit confused... You state to pick up 3 resistors and 2 caps from Rat Shack... yet in your image of your circuit I see 3 caps and 2 resistors...
AB-737 is offline   Reply With Quote
Old 07-12-2011, 03:39 PM   #20
AB-737
Scooby Newbie
 
Member#: 236196
Join Date: Jan 2010
Default

FYI, Tactrix still offers ECU recovery Services. I just sent them my 07 Legacy ECU today.
AB-737 is offline   Reply With Quote
Old 10-28-2011, 01:53 AM   #21
jareds
Scooby Newbie
 
Member#: 249729
Join Date: Jun 2010
Vehicle:
2005 ADM WRX
Black

Default

Quote:
Originally Posted by Hyper View Post
I did a big reasearch a while ago and found all the chip specs, and even software and hardware that can be used to unbrick it, but those things cost a fortune...
if you are interested, I can email you all my info gathered on the subject, it might just take a while to recollect it in my memory and put it down on keyboard
Im very keen on all of this info.! If you can find it?
thanks,
Jared
jareds is offline   Reply With Quote
Old 10-28-2011, 07:41 AM   #22
Hyper
Scooby Guru
 
Member#: 15822
Join Date: Feb 2002
Location: MOCKBA
Vehicle:
1999 WRB GM6
2.12cc V9 Type RA

Default

pm me on tuesday, I will have time to dig it up
Hyper is online now   Reply With Quote
Old 01-10-2012, 09:26 PM   #23
Noah
Rustle Crow
Moderator
 
Member#: 111510
Join Date: Apr 2006
Chapter/Region: MWSOC
Location: Chicago area
Vehicle:
05 WRX
03 SV650S

Default

Quote:
Originally Posted by AB-737 View Post
I'm trying to build this and I'm a bit confused... You state to pick up 3 resistors and 2 caps from Rat Shack... yet in your image of your circuit I see 3 caps and 2 resistors...
I'm also building this circuit. As per the timer circuit in the diagram, there are 3 resistors used. 2 build a voltage divider that then feeds pin 7. The other is to attenuate the timer output on pin 3 before it goes to the ECU. What is a bit confusing to me is the rest of USB portion of the circuit. The EHR-5 header and part where the 10uF cap goes is confusing me.

Here is what I've built so far.



Timer circuit is working properly.




What I find particularly confusing is that in the schematic, they use the pinouts for the FTDI chip on the DLP-USB232M board, instead of the pinout for that board.

http://www.ftdichip.com/Support/Docu...FT232BL_BQ.pdf

However, after reading through the documentation from DLP Design, I think I have it working. I will be testing this tomorrow on an 04 STI ECU.

Last edited by Noah; 01-11-2012 at 12:22 AM.
Noah is offline   Reply With Quote
Old 01-11-2012, 08:37 PM   #24
Noah
Rustle Crow
Moderator
 
Member#: 111510
Join Date: Apr 2006
Chapter/Region: MWSOC
Location: Chicago area
Vehicle:
05 WRX
03 SV650S

Default

I think I finally got it to work. Was having issues with my Watchdog timer stability until I modified the circuit a little.

Code:
Flash Development Toolkit and flash programming components
are provided without support

OS: Windows Vista/Server 2008 [Non-Admin]
FCF Settings Applied: SH/7055F, (C:\Program Files (x86)\Renesas\FDT4.08\kernels\ProtB\7055\Renesas\1_0_00\)
FDT API initialised: version 4, 08, 00, 004
Clock Frequency (External) = 10.0000MHz, Clock Mode = 0, CKM = 4, and CKP = 2
Connecting to device 'SH/7055F' on 'COM2'
Configuration:
'BOOT Mode' connection - using emulated interface
Opening port 'COM2' ...
Loading Comms DLL
Loaded Comms DLL
Initiating BOOT SCI sequence
Attempting 9600
Received immediate response from device: 0xAA
Using micro-Kernel : 'C:\Program Files (x86)\Renesas\FDT4.08\kernels\ProtB\7055\Renesas\1_0_00\uGen7055r.cde'
Downloading and verifying micro kernel...
Device is erasing...
Erase Timeout value set to 21 seconds
Erase Successful
micro-Kernel download successful
Sending inquiry for getting line size
Buffer size has been set to default (128 bytes)
Sending selection of device command
Selection of Device - Device selected, code 0405
Sending selection of clock mode
Sending selection of clock mode
Selection of Clock Mode - Clock selected, code 0
Changing baud rate to 38400 bps
Set baud rate value = 38400
Downloading main kernel 'C:\Program Files (x86)\Renesas\FDT4.08\kernels\ProtB\7055\Renesas\1_0_00\Genm7055.cde'
Main kernel download complete...
Connection complete
Erasing 16 blocks from device
Erasing... 'EB0'...
Downloaded the operation module
Erased block EB0 (0x00000000 - 0x00000FFF)
Erasing... 'EB1'...
Erased block EB1 (0x00001000 - 0x00001FFF)
Erasing... 'EB2'...
Erased block EB2 (0x00002000 - 0x00002FFF)
Erasing... 'EB3'...
Erased block EB3 (0x00003000 - 0x00003FFF)
Erasing... 'EB4'...
Erased block EB4 (0x00004000 - 0x00004FFF)
Erasing... 'EB5'...
Erased block EB5 (0x00005000 - 0x00005FFF)
Erasing... 'EB6'...
Erased block EB6 (0x00006000 - 0x00006FFF)
Erasing... 'EB7'...
Erased block EB7 (0x00007000 - 0x00007FFF)
Erasing... 'EB8'...
Erased block EB8 (0x00008000 - 0x0000FFFF)
Erasing... 'EB9'...
Erased block EB9 (0x00010000 - 0x0001FFFF)
Erasing... 'EB10'...
Erased block EB10 (0x00020000 - 0x0002FFFF)
Erasing... 'EB11'...
Erased block EB11 (0x00030000 - 0x0003FFFF)
Erasing... 'EB12'...
Erased block EB12 (0x00040000 - 0x0004FFFF)
Erasing... 'EB13'...
Erased block EB13 (0x00050000 - 0x0005FFFF)
Erasing... 'EB14'...
Erased block EB14 (0x00060000 - 0x0006FFFF)
Erasing... 'EB15'...
Erased block EB15 (0x00070000 - 0x0007FFFF)
Erase complete
Processing file :"C:\Users\Noah\Desktop\A2ZJ710J - MY04 STi Stock USDM Latest - .bin"
Loading image file : 'C:\Users\Noah\Desktop\A2ZJ710J - MY04 STi Stock USDM Latest - .bin'
Operation on User Flash
Downloaded the operation module
Writing image to device... [0x00000000 - 0x00000B7F]
Writing image to device... [0x00000F80 - 0x0007E67F]
Writing image to device... [0x0007FB80 - 0x0007FFFF]
Data programmed at the following positions:
 0x00000000 - 0x00000B7F      Length : 0x00000B80
 0x00000F80 - 0x0007E67F      Length : 0x0007D700
 0x0007FA80 - 0x0007FAFF      Length : 0x00000080
 0x0007FB80 - 0x0007FFFF      Length : 0x00000480
505.88 K programmed in 585 seconds
Image written to device
Disconnecting
Disconnected
Noah is offline   Reply With Quote
Old 01-12-2012, 05:06 PM   #25
Noah
Rustle Crow
Moderator
 
Member#: 111510
Join Date: Apr 2006
Chapter/Region: MWSOC
Location: Chicago area
Vehicle:
05 WRX
03 SV650S

Default

Confirmed that it worked today. Can read and write via ECUFlash in car.
Noah is offline   Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
How to remove an ecu Quackyboy Newbies & FAQs 9 04-22-2010 09:26 AM
How to Make an STI Look Like a Sleeper? FostersAFB General Community 88 10-20-2004 09:29 PM
How bad is it on the tranny to treat an auto like a manual? thrillho Transmission (AT/MT) & Driveline 8 06-07-2004 08:23 AM
Want to learn how to tune an ECU...and actually do it on a real dyno? 2000vfr800 Engine Management & Tuning 9 03-19-2003 02:20 PM
How long for an ECU to reset w/ no flash? Keith99RS New England Impreza Club Forum -- NESIC 0 08-22-2002 03:28 PM


All times are GMT -4. The time now is 06:38 AM.


Powered by vBulletin® Version 3.7.0
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Powered by Searchlight © 2014 Axivo Inc.
Copyright ©1999 - 2014, North American Subaru Impreza Owners Club, Inc.