View Single Post
Old 06-21-2011, 12:30 PM   #1
Scooby Newbie
Member#: 193628
Join Date: Nov 2008
Chapter/Region: E. Canada
Location: Canada
2010 STI

Default How to Unbrick an ECU. Like A Boss!

A laptop crash half way through a reflash of my buddies 04 sti rendered the ecu useless. This event drove me to figure out how to recover a bricked ecu.

The forums can be confusing to read and understand and pictures of the rig built/hooked up are scarce. On top of that, tactrix doesn't offer the ecu recovery service anymore so I had to get right into it.

First of all, you need to be able to soldier or have a friend who can and is willing to help you out to build this thing.

The parts you will need..

Buy this.. DLP-USB232M from

Click Here

The DLP has most of the circut built for you already so you dont need all kinds of parts, only a few.

Here is the pdf of the thing you need to build

Here is the DLP schematic (last page). Compare these two and you see that you only need a L1 Ferrite.. AKA a coil of wire for noise removal and you need a .01uf capacitor (reads 103 on it). They connect to EHR-5 pin 1.

VCC is usb voltage.. The down arrow in the shbootmode pdf is ground. The DLP needs to be self powered so you must make a connection on the pins to make it do that. Page 6 of this pdf will tell you how to do that. This is also where the vcc voltage is found.

Reset# goes to vcc
CTS#, DSR# and DCD# go to ground.

After that.. Pick up
Bread board
555 timer (radio shack)
a 47.5k resistor
2 1k resistors
and a 100nf capactor (has 104 on it)

Build the timer circuit using the same source for vcc and ground as your main circuit and that should make the nessicary 150 hz signal for the 'watch dog' signal.

Attach your circuit to the board as shown here..

p405 (pink) is VCC
p407 (purple) is the 150 hz 555 timer signal
p409 (orange) is TX
p411 (yellow) is RX
p413 (black) is ground.. this also goes to one side of the capacitor as shown.

After a lot of cursing you should have the following.

The ecu also needs to be powered up via a car battery or power supply. I powered up a lot of pins and when properly powered the ecu should draw around 400 ma of current.

Thick wires are 12v (incl black wire) and thin wires are ground. Hook up to power like so.. (this was an 04 ecu so check your own wiring diagram to see which ones need to be powered up on yours)

Now.. Tactrix's website tells you to use their application to recover the ecu.. It would not work for me. Some ppl can get it to work but with this setup I had to go a slightly different route.

Trying ecu flash generated this message:
[22:16:12.954] Using interface USB <-> Serial
[22:16:14.839] sending bit rate sync bytes...
[22:16:14.839] received bit rate adjust response
sending boot command
[22:16:15.370] received bit rate adjust response
sending boot command
[22:16:15.900] received bit rate adjust response
sending boot command
[22:16:16.431] received bit rate adjust response
sending boot command

etc.... it didnt work..

So go here.

Renesas Flash developer toolkit

Sign up and download the fdt application.

Run developer toolkit basic and search for your renesas ecu in the list.. this one was the 7055. Its written on top of the biggest chip on the ecu.

After that you will be here..

To load your tune (.hex file) into the application you must change the .hex extension to .bin. Before clicking 'program flash' its just like flashing the ecu in the car you must time the click the button a split second after you apply power to the ecu. If you succeed you will be rewarded with the following:

Clock Frequency (External) = 10.0000MHz, Clock Mode = 0, CKM = 4, and CKP = 2
Connecting to device 'SH7055F' on 'COM8'
'BOOT Mode' connection - using emulated interface
Opening port 'COM8' ...
Loading Comms DLL
Loaded Comms DLL
Initiating BOOT SCI sequence
Attempting 9600
Received immediate response from device 0xAA
Using micro-Kernel 'CProgram Files (x86)RenesasFDT4.07kernelsProtB7055Renesas1_0_00uG en7055r.cde'
Downloading and verifying micro kernel...
Device is erasing...
Erase Timeout value set to 21 seconds
Erase Successful
micro-Kernel download successful
Sending inquiry for getting line size
Buffer size has been set to default (128 bytes)
Sending selection of device command
Selection of Device - Device selected, code 0405
Sending selection of clock mode
Sending selection of clock mode
Selection of Clock Mode - Clock selected, code 0
Changing baud rate to 38400 bps
Set baud rate value = 38400
Downloading main kernel 'CProgram Files (x86)RenesasFDT4.07kernelsProtB7055Renesas1_0_00Ge nm7055.cde'
Main kernel download complete...
Connection complete
Processing file CUsersFrankDesktop2004 STI LC+FFS cobb settings.bin
Loading image file 'CUsersFrankDesktop2004 STI LC+FFS cobb settings.bin'
Operation on User Flash
Downloaded the operation module
Writing image to device... [0x00000000 - 0x00000B7F]
Writing image to device... [0x00000F80 - 0x00001EFF]
Writing image to device... [0x00001F80 - 0x0005FE7F]
Writing image to device... [0x0005FE80 - 0x0007D97F]
Writing image to device... [0x0007E700 - 0x0007E77F]
Writing image to device... [0x0007FA80 - 0x0007FAFF]
Writing image to device... [0x0007FB80 - 0x0007FFFF]
Data programmed at the following positions
0x00000000 - 0x00000B7F Length 0x00000B80
0x00000F80 - 0x00001EFF Length 0x00000F80
0x00001F80 - 0x0005FE7F Length 0x0005DF00
0x0005FE80 - 0x0007D97F Length 0x0001DB00
0x0007E700 - 0x0007E77F Length 0x00000080
0x0007FA80 - 0x0007FAFF Length 0x00000080
0x0007FB80 - 0x0007FFFF Length 0x00000480
502.63 K programmed in 609 seconds
Image written to device

Holy crap it worked! Remove the connections from the ecu and put it back in the car. Enjoy your non bricked ecu.

I'll add to this post if I left anything out.

If you need help building this rig or want me to try and unbrick your ecu for you just send me a pm and I will be happy to help you out!
* Registered users of the site do not see these ads.
Franko is offline   Reply With Quote