|
|
|
|
Thread Tools | Display Modes |
|
06-21-2011, 12:30 PM | #1 |
Scooby Newbie
Member#: 193628
Join Date: Nov 2008
Chapter/Region:
E. Canada
Location: Canada
Vehicle:2010 STI SSM |
How to Unbrick an ECU. Like A Boss!
A laptop crash half way through a reflash of my buddies 04 sti rendered the ecu useless. This event drove me to figure out how to recover a bricked ecu.
The forums can be confusing to read and understand and pictures of the rig built/hooked up are scarce. On top of that, tactrix doesn't offer the ecu recovery service anymore so I had to get right into it. First of all, you need to be able to soldier or have a friend who can and is willing to help you out to build this thing. The parts you will need.. Buy this.. DLP-USB232M from mouser.com Click Here The DLP has most of the circut built for you already so you dont need all kinds of parts, only a few. Here is the pdf of the thing you need to build Here is the DLP schematic (last page). Compare these two and you see that you only need a L1 Ferrite.. AKA a coil of wire for noise removal and you need a .01uf capacitor (reads 103 on it). They connect to EHR-5 pin 1. VCC is usb voltage.. The down arrow in the shbootmode pdf is ground. The DLP needs to be self powered so you must make a connection on the pins to make it do that. Page 6 of this pdf will tell you how to do that. This is also where the vcc voltage is found. Reset# goes to vcc CTS#, DSR# and DCD# go to ground. After that.. Pick up Bread board 555 timer (radio shack) a 47.5k resistor 2 1k resistors and a 100nf capactor (has 104 on it) Build the timer circuit using the same source for vcc and ground as your main circuit and that should make the nessicary 150 hz signal for the 'watch dog' signal. Attach your circuit to the board as shown here.. p405 (pink) is VCC p407 (purple) is the 150 hz 555 timer signal p409 (orange) is TX p411 (yellow) is RX p413 (black) is ground.. this also goes to one side of the capacitor as shown. After a lot of cursing you should have the following. The ecu also needs to be powered up via a car battery or power supply. I powered up a lot of pins and when properly powered the ecu should draw around 400 ma of current. Thick wires are 12v (incl black wire) and thin wires are ground. Hook up to power like so.. (this was an 04 ecu so check your own wiring diagram to see which ones need to be powered up on yours) Now.. Tactrix's website tells you to use their application to recover the ecu.. It would not work for me. Some ppl can get it to work but with this setup I had to go a slightly different route. Trying ecu flash generated this message: [22:16:12.954] Using interface USB <-> Serial [22:16:14.839] sending bit rate sync bytes... [22:16:14.839] received bit rate adjust response sending boot command [22:16:15.370] received bit rate adjust response sending boot command [22:16:15.900] received bit rate adjust response sending boot command [22:16:16.431] received bit rate adjust response sending boot command etc.... it didnt work.. So go here. Renesas Flash developer toolkit Sign up and download the fdt application. Run developer toolkit basic and search for your renesas ecu in the list.. this one was the 7055. Its written on top of the biggest chip on the ecu. After that you will be here.. To load your tune (.hex file) into the application you must change the .hex extension to .bin. Before clicking 'program flash' its just like flashing the ecu in the car you must time the click the button a split second after you apply power to the ecu. If you succeed you will be rewarded with the following: Clock Frequency (External) = 10.0000MHz, Clock Mode = 0, CKM = 4, and CKP = 2 Connecting to device 'SH7055F' on 'COM8' Configuration 'BOOT Mode' connection - using emulated interface Opening port 'COM8' ... Loading Comms DLL Loaded Comms DLL Initiating BOOT SCI sequence Attempting 9600 Received immediate response from device 0xAA Using micro-Kernel 'CProgram Files (x86)RenesasFDT4.07kernelsProtB7055Renesas1_0_00uG en7055r.cde' Downloading and verifying micro kernel... Device is erasing... Erase Timeout value set to 21 seconds Erase Successful micro-Kernel download successful Sending inquiry for getting line size Buffer size has been set to default (128 bytes) Sending selection of device command Selection of Device - Device selected, code 0405 Sending selection of clock mode Sending selection of clock mode Selection of Clock Mode - Clock selected, code 0 Changing baud rate to 38400 bps Set baud rate value = 38400 Downloading main kernel 'CProgram Files (x86)RenesasFDT4.07kernelsProtB7055Renesas1_0_00Ge nm7055.cde' Main kernel download complete... Connection complete Processing file CUsersFrankDesktop2004 STI LC+FFS cobb settings.bin Loading image file 'CUsersFrankDesktop2004 STI LC+FFS cobb settings.bin' Operation on User Flash Downloaded the operation module Writing image to device... [0x00000000 - 0x00000B7F] Writing image to device... [0x00000F80 - 0x00001EFF] Writing image to device... [0x00001F80 - 0x0005FE7F] Writing image to device... [0x0005FE80 - 0x0007D97F] Writing image to device... [0x0007E700 - 0x0007E77F] Writing image to device... [0x0007FA80 - 0x0007FAFF] Writing image to device... [0x0007FB80 - 0x0007FFFF] Data programmed at the following positions 0x00000000 - 0x00000B7F Length 0x00000B80 0x00000F80 - 0x00001EFF Length 0x00000F80 0x00001F80 - 0x0005FE7F Length 0x0005DF00 0x0005FE80 - 0x0007D97F Length 0x0001DB00 0x0007E700 - 0x0007E77F Length 0x00000080 0x0007FA80 - 0x0007FAFF Length 0x00000080 0x0007FB80 - 0x0007FFFF Length 0x00000480 502.63 K programmed in 609 seconds Image written to device Disconnecting Disconnected Holy crap it worked! Remove the connections from the ecu and put it back in the car. Enjoy your non bricked ecu. I'll add to this post if I left anything out. If you need help building this rig or want me to try and unbrick your ecu for you just send me a pm and I will be happy to help you out! |
06-21-2011, 12:47 PM | #2 |
Scooby Specialist
Member#: 271720
Join Date: Jan 2011
Chapter/Region:
Tri-State
Location: NEPA
|
|
06-21-2011, 03:06 PM | #3 |
Scooby Specialist
Member#: 232458
Join Date: Dec 2009
Chapter/Region:
SWIC
Location: Las Cruces/El Paso
Vehicle:2005 & 2008 STi Cobb 20g & EFR 7670 |
Wow, that's awesome work Franko!!! This is going to save a lot of people who are component savvy some time and $$. Great work!
|
06-21-2011, 11:32 PM | #4 |
Scooby Guru
Member#: 140444
Join Date: Feb 2007
Chapter/Region:
NWIC
Location: Near Seattle, WA
Vehicle:05 Stage Free LGT ATP 3076, 6MT, AVO FMIC |
Bravo.
|
06-22-2011, 11:45 AM | #5 |
Scooby Guru
Member#: 15822
Join Date: Feb 2002
Location: TOPOHTO
Vehicle:1999 WRB GM6 2.34 LR destroker |
too bad it doesn't work with 16bit ECUs
|
06-23-2011, 08:50 PM | #6 |
Scooby Newbie
Member#: 193628
Join Date: Nov 2008
Chapter/Region:
E. Canada
Location: Canada
Vehicle:2010 STI SSM |
|
06-24-2011, 01:39 PM | #7 |
Scooby Specialist
Member#: 170906
Join Date: Feb 2008
Chapter/Region:
RMIC
Vehicle:2002 WRX psm |
|
07-05-2011, 12:42 PM | #8 | |
Scooby Guru
Member#: 15822
Join Date: Feb 2002
Location: TOPOHTO
Vehicle:1999 WRB GM6 2.34 LR destroker |
Quote:
if you are interested, I can email you all my info gathered on the subject, it might just take a while to recollect it in my memory and put it down on keyboard |
|
10-28-2011, 01:53 AM | #9 | |
Scooby Newbie
Member#: 249729
Join Date: Jun 2010
Vehicle:2005 ADM WRX Black |
Quote:
thanks, Jared |
|
06-23-2011, 07:40 AM | #10 |
Sammo Hung
Moderator Member#: 10613
Join Date: Sep 2001
Chapter/Region:
South East
Location: N Fla / S Ga
Vehicle:2002 USDM WRX WRB |
nice job!
going to have build one of those myself. so i can unbrick ecu's |
06-23-2011, 12:31 PM | #11 |
Scooby Specialist
Member#: 283134
Join Date: May 2011
Location: AZ
Vehicle:2015 STi LE EFR7163 500whp/550wtq |
holy crap
|
06-23-2011, 11:15 PM | #12 |
Scooby Guru
Member#: 9960
Join Date: Sep 2001
Location: in bed...
Vehicle:2002 Impreza WRX WRBlue Perl |
Nice! Perhaps the contents of this thread should become a sticky?
|
06-24-2011, 01:48 AM | #13 |
Scooby Specialist
Member#: 52314
Join Date: Jan 2004
Chapter/Region:
South East
Location: Following the green weenie
Vehicle:... 02 and 04 WRXs! 2020 G70 3.3T RWD |
This seems like an appropriate place to comment about the 16 bit ecu. I thought I bricked mine today as a loose USB port connection caused a flash to interrupt. Nothing would work and the car was stuck in test mode. For whatever reason, unhooking the negative battery cable for a few minutes and then trying it worked to flash it and get it running again.
|
06-24-2011, 09:41 AM | #14 |
Scooby Newbie
Member#: 204728
Join Date: Mar 2009
Chapter/Region:
MAIC
Location: NOVA
Vehicle:2004 STI Blue |
Wow Franko!! This is a great thread, and I wish more people would post like this. Thanks +1 for sticky. I think my newer ecu(replaced last year) just shat itself again.....
|
06-24-2011, 10:42 AM | #15 |
Scooby Specialist
Member#: 192599
Join Date: Oct 2008
Chapter/Region:
MAIC
Location: Reading, PA
Vehicle:2004 STI 2007 Outback Wagon |
Amazing. I have this thread saved incase I ever brick my unit.
|
06-24-2011, 06:32 PM | #16 |
Scooby Specialist
Member#: 198721
Join Date: Dec 2008
Chapter/Region:
MWSOC
Location: Chicago
Vehicle:1994 gc8 Red |
nice work congrats, have two bricked ecu, time to bring them back to live
Just like others notice, someone has to finish you work and find out how to do 16bit |
06-24-2011, 06:35 PM | #17 |
Scooby Guru
Member#: 59993
Join Date: Apr 2004
Chapter/Region:
International
Location: WWAAYY west of the Mississippi
Vehicle:Ass, grass or cash no one rides for free!! |
Very nice! Sticky!!!!
|
07-05-2011, 08:18 AM | #18 |
Scooby Newbie
Member#: 265981
Join Date: Dec 2010
Vehicle:2011 STi Sedan DGM |
Wow, this is great! What's the specs of the ferrite bead? Where did you get it?
|
07-05-2011, 08:28 AM | #19 |
Scooby Specialist
Member#: 174442
Join Date: Mar 2008
Chapter/Region:
Tri-State
Location: NNJ
Vehicle:2007 SuperWagon I don't spell well |
holy crap... you are awesome!
|
07-11-2011, 12:12 PM | #20 |
Scooby Newbie
Member#: 236196
Join Date: Jan 2010
|
I'm trying to build this and I'm a bit confused... You state to pick up 3 resistors and 2 caps from Rat Shack... yet in your image of your circuit I see 3 caps and 2 resistors...
|
01-10-2012, 09:26 PM | #21 | |
( ͡° ͜ʖ ͡°)
Moderator Member#: 111510
Join Date: Apr 2006
Chapter/Region:
MWSOC
Location: Chicago area
Vehicle:04 WRX 16 Xtrek 19 XSR900 |
Quote:
Here is what I've built so far. Timer circuit is working properly. What I find particularly confusing is that in the schematic, they use the pinouts for the FTDI chip on the DLP-USB232M board, instead of the pinout for that board. http://www.ftdichip.com/Support/Docu...FT232BL_BQ.pdf However, after reading through the documentation from DLP Design, I think I have it working. I will be testing this tomorrow on an 04 STI ECU. Last edited by Noah; 01-11-2012 at 12:22 AM. |
|
07-12-2011, 03:39 PM | #22 |
Scooby Newbie
Member#: 236196
Join Date: Jan 2010
|
FYI, Tactrix still offers ECU recovery Services. I just sent them my 07 Legacy ECU today.
|
10-28-2011, 07:41 AM | #23 |
Scooby Guru
Member#: 15822
Join Date: Feb 2002
Location: TOPOHTO
Vehicle:1999 WRB GM6 2.34 LR destroker |
pm me on tuesday, I will have time to dig it up
|
01-11-2012, 08:37 PM | #24 |
( ͡° ͜ʖ ͡°)
Moderator Member#: 111510
Join Date: Apr 2006
Chapter/Region:
MWSOC
Location: Chicago area
Vehicle:04 WRX 16 Xtrek 19 XSR900 |
I think I finally got it to work. Was having issues with my Watchdog timer stability until I modified the circuit a little.
Code:
Flash Development Toolkit and flash programming components are provided without support OS: Windows Vista/Server 2008 [Non-Admin] FCF Settings Applied: SH/7055F, (C:\Program Files (x86)\Renesas\FDT4.08\kernels\ProtB\7055\Renesas\1_0_00\) FDT API initialised: version 4, 08, 00, 004 Clock Frequency (External) = 10.0000MHz, Clock Mode = 0, CKM = 4, and CKP = 2 Connecting to device 'SH/7055F' on 'COM2' Configuration: 'BOOT Mode' connection - using emulated interface Opening port 'COM2' ... Loading Comms DLL Loaded Comms DLL Initiating BOOT SCI sequence Attempting 9600 Received immediate response from device: 0xAA Using micro-Kernel : 'C:\Program Files (x86)\Renesas\FDT4.08\kernels\ProtB\7055\Renesas\1_0_00\uGen7055r.cde' Downloading and verifying micro kernel... Device is erasing... Erase Timeout value set to 21 seconds Erase Successful micro-Kernel download successful Sending inquiry for getting line size Buffer size has been set to default (128 bytes) Sending selection of device command Selection of Device - Device selected, code 0405 Sending selection of clock mode Sending selection of clock mode Selection of Clock Mode - Clock selected, code 0 Changing baud rate to 38400 bps Set baud rate value = 38400 Downloading main kernel 'C:\Program Files (x86)\Renesas\FDT4.08\kernels\ProtB\7055\Renesas\1_0_00\Genm7055.cde' Main kernel download complete... Connection complete Erasing 16 blocks from device Erasing... 'EB0'... Downloaded the operation module Erased block EB0 (0x00000000 - 0x00000FFF) Erasing... 'EB1'... Erased block EB1 (0x00001000 - 0x00001FFF) Erasing... 'EB2'... Erased block EB2 (0x00002000 - 0x00002FFF) Erasing... 'EB3'... Erased block EB3 (0x00003000 - 0x00003FFF) Erasing... 'EB4'... Erased block EB4 (0x00004000 - 0x00004FFF) Erasing... 'EB5'... Erased block EB5 (0x00005000 - 0x00005FFF) Erasing... 'EB6'... Erased block EB6 (0x00006000 - 0x00006FFF) Erasing... 'EB7'... Erased block EB7 (0x00007000 - 0x00007FFF) Erasing... 'EB8'... Erased block EB8 (0x00008000 - 0x0000FFFF) Erasing... 'EB9'... Erased block EB9 (0x00010000 - 0x0001FFFF) Erasing... 'EB10'... Erased block EB10 (0x00020000 - 0x0002FFFF) Erasing... 'EB11'... Erased block EB11 (0x00030000 - 0x0003FFFF) Erasing... 'EB12'... Erased block EB12 (0x00040000 - 0x0004FFFF) Erasing... 'EB13'... Erased block EB13 (0x00050000 - 0x0005FFFF) Erasing... 'EB14'... Erased block EB14 (0x00060000 - 0x0006FFFF) Erasing... 'EB15'... Erased block EB15 (0x00070000 - 0x0007FFFF) Erase complete Processing file :"C:\Users\Noah\Desktop\A2ZJ710J - MY04 STi Stock USDM Latest - .bin" Loading image file : 'C:\Users\Noah\Desktop\A2ZJ710J - MY04 STi Stock USDM Latest - .bin' Operation on User Flash Downloaded the operation module Writing image to device... [0x00000000 - 0x00000B7F] Writing image to device... [0x00000F80 - 0x0007E67F] Writing image to device... [0x0007FB80 - 0x0007FFFF] Data programmed at the following positions: 0x00000000 - 0x00000B7F Length : 0x00000B80 0x00000F80 - 0x0007E67F Length : 0x0007D700 0x0007FA80 - 0x0007FAFF Length : 0x00000080 0x0007FB80 - 0x0007FFFF Length : 0x00000480 505.88 K programmed in 585 seconds Image written to device Disconnecting Disconnected |
01-12-2012, 05:06 PM | #25 |
( ͡° ͜ʖ ͡°)
Moderator Member#: 111510
Join Date: Apr 2006
Chapter/Region:
MWSOC
Location: Chicago area
Vehicle:04 WRX 16 Xtrek 19 XSR900 |
Confirmed that it worked today. Can read and write via ECUFlash in car.
|
Thread Tools | |
Display Modes | |
|
|
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
How to Make an STI Look Like a Sleeper? | FostersAFB | General Community | 92 | 10-12-2017 09:24 PM |
How to remove an ecu | Quackyboy | Newbies & FAQs | 9 | 04-22-2010 09:26 AM |
How bad is it on the tranny to treat an auto like a manual? | thrillho | Transmission (AT/MT) & Driveline | 8 | 06-07-2004 08:23 AM |
Want to learn how to tune an ECU...and actually do it on a real dyno? | 2000vfr800 | Engine Management & Tuning | 9 | 03-19-2003 02:20 PM |
How long for an ECU to reset w/ no flash? | Keith99RS | New England Impreza Club Forum -- NESIC | 0 | 08-22-2002 03:28 PM |