Welcome to the North American Subaru Impreza Owners Club Friday August 18, 2017
Home Forums WikiNASIOC Products Store Modifications Upgrade Garage
Go Back   NASIOC > NASIOC Technical > Engine Management & Tuning

Welcome to NASIOC - The world's largest online community for Subaru enthusiasts!
Welcome to the NASIOC.com Subaru forum.

You are currently viewing our forum as a guest, which gives you limited access to view most discussions and access our other features. By joining our community, free of charge, you will have access to post topics, communicate privately with other members (PM), respond to polls, upload content and access many other special features. Registration is free, fast and simple, so please join our community today!

If you have any problems with the registration process or your account login, please contact us.
* Registered users of the site do not see these ads. 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
Old 06-21-2011, 12:30 PM   #1
Scooby Newbie
Member#: 193628
Join Date: Nov 2008
Chapter/Region: E. Canada
Location: Canada
2010 STI

Default How to Unbrick an ECU. Like A Boss!

A laptop crash half way through a reflash of my buddies 04 sti rendered the ecu useless. This event drove me to figure out how to recover a bricked ecu.

The forums can be confusing to read and understand and pictures of the rig built/hooked up are scarce. On top of that, tactrix doesn't offer the ecu recovery service anymore so I had to get right into it.

First of all, you need to be able to soldier or have a friend who can and is willing to help you out to build this thing.

The parts you will need..

Buy this.. DLP-USB232M from mouser.com

Click Here

The DLP has most of the circut built for you already so you dont need all kinds of parts, only a few.

Here is the pdf of the thing you need to build

Here is the DLP schematic (last page). Compare these two and you see that you only need a L1 Ferrite.. AKA a coil of wire for noise removal and you need a .01uf capacitor (reads 103 on it). They connect to EHR-5 pin 1.

VCC is usb voltage.. The down arrow in the shbootmode pdf is ground. The DLP needs to be self powered so you must make a connection on the pins to make it do that. Page 6 of this pdf will tell you how to do that. This is also where the vcc voltage is found.

Reset# goes to vcc
CTS#, DSR# and DCD# go to ground.

After that.. Pick up
Bread board
555 timer (radio shack)
a 47.5k resistor
2 1k resistors
and a 100nf capactor (has 104 on it)

Build the timer circuit using the same source for vcc and ground as your main circuit and that should make the nessicary 150 hz signal for the 'watch dog' signal.

Attach your circuit to the board as shown here..

p405 (pink) is VCC
p407 (purple) is the 150 hz 555 timer signal
p409 (orange) is TX
p411 (yellow) is RX
p413 (black) is ground.. this also goes to one side of the capacitor as shown.

After a lot of cursing you should have the following.

The ecu also needs to be powered up via a car battery or power supply. I powered up a lot of pins and when properly powered the ecu should draw around 400 ma of current.

Thick wires are 12v (incl black wire) and thin wires are ground. Hook up to power like so.. (this was an 04 ecu so check your own wiring diagram to see which ones need to be powered up on yours)

Now.. Tactrix's website tells you to use their application to recover the ecu.. It would not work for me. Some ppl can get it to work but with this setup I had to go a slightly different route.

Trying ecu flash generated this message:
[22:16:12.954] Using interface USB <-> Serial
[22:16:14.839] sending bit rate sync bytes...
[22:16:14.839] received bit rate adjust response
sending boot command
[22:16:15.370] received bit rate adjust response
sending boot command
[22:16:15.900] received bit rate adjust response
sending boot command
[22:16:16.431] received bit rate adjust response
sending boot command

etc.... it didnt work..

So go here.

Renesas Flash developer toolkit

Sign up and download the fdt application.

Run developer toolkit basic and search for your renesas ecu in the list.. this one was the 7055. Its written on top of the biggest chip on the ecu.

After that you will be here..

To load your tune (.hex file) into the application you must change the .hex extension to .bin. Before clicking 'program flash' its just like flashing the ecu in the car you must time the click the button a split second after you apply power to the ecu. If you succeed you will be rewarded with the following:

Clock Frequency (External) = 10.0000MHz, Clock Mode = 0, CKM = 4, and CKP = 2
Connecting to device 'SH7055F' on 'COM8'
'BOOT Mode' connection - using emulated interface
Opening port 'COM8' ...
Loading Comms DLL
Loaded Comms DLL
Initiating BOOT SCI sequence
Attempting 9600
Received immediate response from device 0xAA
Using micro-Kernel 'CProgram Files (x86)RenesasFDT4.07kernelsProtB7055Renesas1_0_00uG en7055r.cde'
Downloading and verifying micro kernel...
Device is erasing...
Erase Timeout value set to 21 seconds
Erase Successful
micro-Kernel download successful
Sending inquiry for getting line size
Buffer size has been set to default (128 bytes)
Sending selection of device command
Selection of Device - Device selected, code 0405
Sending selection of clock mode
Sending selection of clock mode
Selection of Clock Mode - Clock selected, code 0
Changing baud rate to 38400 bps
Set baud rate value = 38400
Downloading main kernel 'CProgram Files (x86)RenesasFDT4.07kernelsProtB7055Renesas1_0_00Ge nm7055.cde'
Main kernel download complete...
Connection complete
Processing file CUsersFrankDesktop2004 STI LC+FFS cobb settings.bin
Loading image file 'CUsersFrankDesktop2004 STI LC+FFS cobb settings.bin'
Operation on User Flash
Downloaded the operation module
Writing image to device... [0x00000000 - 0x00000B7F]
Writing image to device... [0x00000F80 - 0x00001EFF]
Writing image to device... [0x00001F80 - 0x0005FE7F]
Writing image to device... [0x0005FE80 - 0x0007D97F]
Writing image to device... [0x0007E700 - 0x0007E77F]
Writing image to device... [0x0007FA80 - 0x0007FAFF]
Writing image to device... [0x0007FB80 - 0x0007FFFF]
Data programmed at the following positions
0x00000000 - 0x00000B7F Length 0x00000B80
0x00000F80 - 0x00001EFF Length 0x00000F80
0x00001F80 - 0x0005FE7F Length 0x0005DF00
0x0005FE80 - 0x0007D97F Length 0x0001DB00
0x0007E700 - 0x0007E77F Length 0x00000080
0x0007FA80 - 0x0007FAFF Length 0x00000080
0x0007FB80 - 0x0007FFFF Length 0x00000480
502.63 K programmed in 609 seconds
Image written to device

Holy crap it worked! Remove the connections from the ecu and put it back in the car. Enjoy your non bricked ecu.

I'll add to this post if I left anything out.

If you need help building this rig or want me to try and unbrick your ecu for you just send me a pm and I will be happy to help you out!
Franko is offline   Reply With Quote

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
How to remove an ecu Quackyboy Newbies & FAQs 9 04-22-2010 09:26 AM
How to Make an STI Look Like a Sleeper? FostersAFB General Community 88 10-20-2004 09:29 PM
How bad is it on the tranny to treat an auto like a manual? thrillho Transmission (AT/MT) & Driveline 8 06-07-2004 08:23 AM
Want to learn how to tune an ECU...and actually do it on a real dyno? 2000vfr800 Engine Management & Tuning 9 03-19-2003 02:20 PM
How long for an ECU to reset w/ no flash? Keith99RS New England Impreza Club Forum -- NESIC 0 08-22-2002 03:28 PM

All times are GMT -4. The time now is 12:28 AM.

Powered by vBulletin® Version 3.7.0
Copyright ©2000 - 2017, Jelsoft Enterprises Ltd.
Powered by Searchlight © 2017 Axivo Inc.
Copyright ©1999 - 2017, North American Subaru Impreza Owners Club, Inc.