Members Login
Username 
 
Password 
    Remember Me  
ECU hacking -> Suzuki GSX1300R Hayabusa Gen II -> Reviving a Bricked ECU
Post Info TOPIC: Reviving a Bricked ECU
jkwool


Guru

Status: Offline
Posts: 1233
Date:
Reviving a Bricked ECU
Permalink  

I have had 2 customers who have inadvertantly pulled the flashing cable out in the initial erase part of the flashing process. This has caused some issues with the ecu's going into an unresponsive (bricked) state. I am able to initialize communications with them for flashing, sync the baud rate, but at the point where the software tries to unlock the ecu the flashing fails, i have tried flashing with different unlock codes including all 0x00 and all 0xFF but nothing seems to work.

So the ecu is bricked i hear you say, well here is where it gets interesting. There is a guy in the UK who is able to revive the ecu's from this state. He has done a few now. I have contacted him but he is unable to share the technique that he uses as it is some software that he has access to via the military. I know that it communicates with the ecu via the 4 standard flashing pins i.e. TXD, RXD, RTS, CTS and does not require the ecu to be cut open, so nothing fancy on the hardware side, so it must be sending some command to the ecu to reset it over the serial flashing interface... this effectively un-bricks the ecu and allows it to be flashed again as normal.

I would love to work out how to do this, as it would be great to be able to offer everyone the ability to recover from this bricked state should this happen to their ecu's. Anyone got any ideas on what the commands could be that are being issued to the ecu to reset it?!?!

Cheers

-Justin.



__________________

site_logo_small.png

www.WoolichRacing.comTune your bike to the Limit with our Advanced ECU Flashing Products
sportbikeryder


Guru

Status: Offline
Posts: 1247
Date:
Permalink  



Apparently some of the EVO guys know how to do it. I believe the EVO uses the M32186F8 cpu. The GEN2 busa uses M32196F8

http://www.evoxforums.com/forums/showthread.php?t=35078

http://www.evoscan.com/evoscan-gps-obdii-cables/details/4/1/performance-vehicle-pc-diagnostic-interfaces/mitsubishi/subaru/obdii/can-evoscan-software

__________________
Twice


Senior Member

Status: Offline
Posts: 350
Date:
Permalink  

So you can really brick the M32R,

Donīt the evo guys do everything not AUD with CAN/K-Line? Law on OBD implementation for cars?
CAN is not in the plug right? Is it even enabled? From what is known SDS-motorcycle commands did not have anything like that?
Anyone knows all available SDS commands for Gen2?

By some of the backdoors should be doable?
Justin do you know if he opens the ecu or do it from connector?

Throw it in the microwave for 5 sec. Or try a big ****ing magnet. :)
Take it to the hospital and insist the ecu needs and MR-scan.

__________________
jkwool


Guru

Status: Offline
Posts: 1233
Date:
Permalink  

Yeah he definately does it via the serial flashing pins tx, rx, rts, cts not SDS. I have had a quick look at the info that John posted (thanks John) it will require some more investigation. The ecu is not totally bricked, you can initialize serial communication with it and issue commands and you get a response so its just a matter of finding what the commands are to unlock it :) i offered to help the guy with working it out but he was reluctant to help which was a bit disappointing...

Can I use your microwave to try it ha ha ha.



__________________

site_logo_small.png

www.WoolichRacing.comTune your bike to the Limit with our Advanced ECU Flashing Products
sportbikeryder


Guru

Status: Offline
Posts: 1247
Date:
Permalink  

Justin, there appears for be active tech support for the M32 processors frm FTD, etc. Have you thought about contacting them directly? I wouldn't know enough of the jargon to put into an email, but it may be something like pulsing a signal to the reset 5 times for 5ms each or something, who knows? .

__________________
jkwool


Guru

Status: Offline
Posts: 1233
Date:
Permalink  

sportbikeryder wrote:

Justin, there appears for be active tech support for the M32 processors frm FTD, etc. Have you thought about contacting them directly? I wouldn't know enough of the jargon to put into an email, but it may be something like pulsing a signal to the reset 5 times for 5ms each or something, who knows? .

Ok cool good idea, when you say FTD do you mean Renesas? 

Bricking an ecu is probably one of the biggest fears some guys have so to be able to enabled un-bricking would be pretty cool!



__________________

site_logo_small.png

www.WoolichRacing.comTune your bike to the Limit with our Advanced ECU Flashing Products
sportbikeryder


Guru

Status: Offline
Posts: 1247
Date:
Permalink  

Yes, I meant Renesas. I believe Renesas owns the rights to teh interfaces and support for teh M32R series. Mitsubishi developed it originally.

 

Might be easy to explain gthe issue and where you want to go. Probably best to approach it as an integrator / controls based spproach rather than a "I'm trying to hack a Suzuki" approach...

 



http://www.renesas.com/products/mpumcu/m32r/index.jsp

 

 



__________________
Maj750


Guru

Status: Offline
Posts: 546
Date:
Permalink  

when you figure that out i have a bricked gen 1 you can play with, wire came off the power while flashing, actually happened to 2 ecus before i found the loose wire problem , but after many tries, and i think a reverse polarity one came back to life

__________________
Twice


Senior Member

Status: Offline
Posts: 350
Date:
Permalink  

Indeed this is an issue to solve, probably something that will scare people.
Will cause immo issues for all EU/AU if they need to change ecu. What was his price for resetting them Justin?

Seems like password got messed up when interrupted? Or set in some error state and blocking things.

Found this in manual:

When using a tool to program/erase the internal flash memory such as a general-purpose programmer or
emulator, the ID entered by a tool and the ID stored in the internal flash memory are collated. Unless the correct
ID is entered, the internal flash memory cannot be read out, programmed nor erased. (For some tools, tool
execution is enabled after erasing the entire flash memory area, and the internal flash memory becomes
accessible for write.)

That last part seems to as indicate that "some" tool might be able to erase it and then it would be accessible to write?
But nothing to idicate what tool, Section 6.10. 

Justin do you have any good way to check registers in section 6.5 in manual? Like FBUSY or some others?
Just guessing wild here, this is way over my head and nothing to test on hehe...

Got the microwave here ready when you get pissed off hehe. 



__________________
jkwool


Guru

Status: Offline
Posts: 1233
Date:
Permalink  

Good info Twice, i think he charges a reasonable amount but it would be great if i could build this into the WRT software so anyone can do it ;)

I just had a customer contact me from the US with this exact problem, so i am going to get a replacement ecu to him and ask him to send me his ecu so i have an ecu in the bricked state to work with.

I will try doing a full erase straight after connecting to see if this works... I will also start contacting the links below, to get a solution for this.



__________________

site_logo_small.png

www.WoolichRacing.comTune your bike to the Limit with our Advanced ECU Flashing Products
jkwool


Guru

Status: Offline
Posts: 1233
Date:
Permalink  

I have contacted a couple of the companies that have car flashing software that operates on the m32r, have not received a response yet, i also contacted renesas directly and they did get back to me and request addional info which i provided, they have to go to Japan to get some answers, hope it comes through!



__________________

site_logo_small.png

www.WoolichRacing.comTune your bike to the Limit with our Advanced ECU Flashing Products
sportbikeryder


Guru

Status: Offline
Posts: 1247
Date:
Permalink  

The renesas lead is probably the most promising. Hopefully it pans out.

__________________
Twice


Senior Member

Status: Offline
Posts: 350
Date:
Permalink  

Justin, do you know how to go about checking the status of the registers in 6.5?
Is it the bootloader that loads them up? Can you check them with a simple terminal software and hex commands
like in the old document i sent you for M32C/M16C etc. Remember, just stabbin in the dark here :)


__________________
jkwool


Guru

Status: Offline
Posts: 1233
Date:
Permalink  

Hi Twice,

Hmmm good idea i will have a read over that manual again as there was some good stuff in there, maybe something in the status info will be useful. I am not sure about reading the internal memory status from section 6.5 i will try a few things out.

I should have a bricked ecu soon to experiment with ;)

Keep that microwave on standby.

I agree John, i reckon Renesas is the best bet, althought they came back to me requesting what i was doing so i had to give them some details...

Cheers

-Justin.



__________________

site_logo_small.png

www.WoolichRacing.comTune your bike to the Limit with our Advanced ECU Flashing Products
Turboy750


Veteran Member

Status: Offline
Posts: 52
Date:
Permalink  

I was at the track the other day and my usb came out of the flasher while flashing. I think it has to happen at a certain time because I restarted ee and cycled power to the bike, did a full erase and flashed.
I cannot believe with the amount of drama I put one of my ECU's through it has not "bricked"! I have a spare incase.

__________________

Home Built 06 Gsx-r 750 w/ Disco Potato .60 A/r 6.5lbs Pump gas 100% stock motor 211.54 rwhp...... going for 275 on E85 with ECU editor

Oh make it 237rwhp and 97lbs on E-85 100% stock motor 8lbs of boost. Thanks WIN Racing
Chipwizard


Senior Member

Status: Offline
Posts: 109
Date:
Permalink  

Christian Piasini may be of some help with this....

__________________
jkwool


Guru

Status: Offline
Posts: 1233
Date:
Permalink  

Ok, bit of an update on this. We have worked out how to recover bricked M32R based ECU's. In the past week we have recovered my Busa/B-King bench testing ECU as well as a customers 2012 GSX-R 750 ecu

The process involves cutting open the ECU and exposing the M32R MCU inside and then low level programming of the MCU. Woolich Racing now offer this service on our web site product pages for relevant models e.g. http://www.woolichracing.com/Products.aspx?Manufacturer=Suzuki&Model=GSX1300R%20(Hayabusa)&Year=2012



-- Edited by jkwool on Friday 11th of January 2013 12:38:40 PM

__________________

site_logo_small.png

www.WoolichRacing.comTune your bike to the Limit with our Advanced ECU Flashing Products
sportbikeryder


Guru

Status: Offline
Posts: 1247
Date:
Permalink  

Good find Justin. Would be better if it was do-able through the connector, but could be useful nonetheless.

So the "flashed to death" ecu is back to life?

__________________
jkwool


Guru

Status: Offline
Posts: 1233
Date:
Permalink  

I agree, i have not given up on a solution through the connector ;)

Yes the flashed to death ecu is alive again, it has taken ALOT of flashes, but its back...



__________________

site_logo_small.png

www.WoolichRacing.comTune your bike to the Limit with our Advanced ECU Flashing Products
Page 1 of 1  sorted by
 
Quick Reply

Please log in to post quick replies.
ECU hacking -> Suzuki GSX1300R Hayabusa Gen II -> Reviving a Bricked ECU
Tweet this page Post to Digg Post to Del.icio.us


Create your own FREE Forum
Report Abuse 		Powered by ActiveBoard