I have had 2 customers who have inadvertantly pulled the flashing cable out in the initial erase part of the flashing process. This has caused some issues with the ecu's going into an unresponsive (bricked) state. I am able to initialize communications with them for flashing, sync the baud rate, but at the point where the software tries to unlock the ecu the flashing fails, i have tried flashing with different unlock codes including all 0x00 and all 0xFF but nothing seems to work.
So the ecu is bricked i hear you say, well here is where it gets interesting. There is a guy in the UK who is able to revive the ecu's from this state. He has done a few now. I have contacted him but he is unable to share the technique that he uses as it is some software that he has access to via the military. I know that it communicates with the ecu via the 4 standard flashing pins i.e. TXD, RXD, RTS, CTS and does not require the ecu to be cut open, so nothing fancy on the hardware side, so it must be sending some command to the ecu to reset it over the serial flashing interface... this effectively un-bricks the ecu and allows it to be flashed again as normal.
I would love to work out how to do this, as it would be great to be able to offer everyone the ability to recover from this bricked state should this happen to their ecu's. Anyone got any ideas on what the commands could be that are being issued to the ecu to reset it?!?!
Donīt the evo guys do everything not AUD with CAN/K-Line? Law on OBD implementation for cars? CAN is not in the plug right? Is it even enabled? From what is known SDS-motorcycle commands did not have anything like that? Anyone knows all available SDS commands for Gen2?
By some of the backdoors should be doable? Justin do you know if he opens the ecu or do it from connector?
Throw it in the microwave for 5 sec. Or try a big ****ing magnet. :) Take it to the hospital and insist the ecu needs and MR-scan.
Yeah he definately does it via the serial flashing pins tx, rx, rts, cts not SDS. I have had a quick look at the info that John posted (thanks John) it will require some more investigation. The ecu is not totally bricked, you can initialize serial communication with it and issue commands and you get a response so its just a matter of finding what the commands are to unlock it :) i offered to help the guy with working it out but he was reluctant to help which was a bit disappointing...
Justin, there appears for be active tech support for the M32 processors frm FTD, etc. Have you thought about contacting them directly? I wouldn't know enough of the jargon to put into an email, but it may be something like pulsing a signal to the reset 5 times for 5ms each or something, who knows? .
Justin, there appears for be active tech support for the M32 processors frm FTD, etc. Have you thought about contacting them directly? I wouldn't know enough of the jargon to put into an email, but it may be something like pulsing a signal to the reset 5 times for 5ms each or something, who knows? .
Ok cool good idea, when you say FTD do you mean Renesas?
Bricking an ecu is probably one of the biggest fears some guys have so to be able to enabled un-bricking would be pretty cool!
Yes, I meant Renesas. I believe Renesas owns the rights to teh interfaces and support for teh M32R series. Mitsubishi developed it originally.
Might be easy to explain gthe issue and where you want to go. Probably best to approach it as an integrator / controls based spproach rather than a "I'm trying to hack a Suzuki" approach...
when you figure that out i have a bricked gen 1 you can play with, wire came off the power while flashing, actually happened to 2 ecus before i found the loose wire problem , but after many tries, and i think a reverse polarity one came back to life
Indeed this is an issue to solve, probably something that will scare people. Will cause immo issues for all EU/AU if they need to change ecu. What was his price for resetting them Justin?
Seems like password got messed up when interrupted? Or set in some error state and blocking things.
Found this in manual:
When using a tool to program/erase the internal flash memory such as a general-purpose programmer or emulator, the ID entered by a tool and the ID stored in the internal flash memory are collated. Unless the correct ID is entered, the internal flash memory cannot be read out, programmed nor erased. (For some tools, tool execution is enabled after erasing the entire flash memory area, and the internal flash memory becomes accessible for write.)
That last part seems to as indicate that "some" tool might be able to erase it and then it would be accessible to write? But nothing to idicate what tool, Section 6.10.
Justin do you have any good way to check registers in section 6.5 in manual? Like FBUSY or some others? Just guessing wild here, this is way over my head and nothing to test on hehe...
Got the microwave here ready when you get pissed off hehe.
Good info Twice, i think he charges a reasonable amount but it would be great if i could build this into the WRT software so anyone can do it ;)
I just had a customer contact me from the US with this exact problem, so i am going to get a replacement ecu to him and ask him to send me his ecu so i have an ecu in the bricked state to work with.
I will try doing a full erase straight after connecting to see if this works... I will also start contacting the links below, to get a solution for this.
I have contacted a couple of the companies that have car flashing software that operates on the m32r, have not received a response yet, i also contacted renesas directly and they did get back to me and request addional info which i provided, they have to go to Japan to get some answers, hope it comes through!
Justin, do you know how to go about checking the status of the registers in 6.5? Is it the bootloader that loads them up? Can you check them with a simple terminal software and hex commands like in the old document i sent you for M32C/M16C etc. Remember, just stabbin in the dark here :)
Hmmm good idea i will have a read over that manual again as there was some good stuff in there, maybe something in the status info will be useful. I am not sure about reading the internal memory status from section 6.5 i will try a few things out.
I should have a bricked ecu soon to experiment with ;)
Keep that microwave on standby.
I agree John, i reckon Renesas is the best bet, althought they came back to me requesting what i was doing so i had to give them some details...
I was at the track the other day and my usb came out of the flasher while flashing. I think it has to happen at a certain time because I restarted ee and cycled power to the bike, did a full erase and flashed. I cannot believe with the amount of drama I put one of my ECU's through it has not "bricked"! I have a spare incase.
__________________
Home Built 06 Gsx-r 750 w/ Disco Potato .60 A/r 6.5lbs Pump gas 100% stock motor 211.54 rwhp...... going for 275 on E85 with ECU editor
Oh make it 237rwhp and 97lbs on E-85 100% stock motor 8lbs of boost. Thanks WIN Racing
Ok, bit of an update on this. We have worked out how to recover bricked M32R based ECU's. In the past week we have recovered my Busa/B-King bench testing ECU as well as a customers 2012 GSX-R 750 ecu