USB BDM NT

They go by many names, P01, P59, VPW, '0411 etc. Also covering E38 and newer here.
Post Reply
User avatar
DavidBraley
Posts: 172
Joined: Thu Jun 07, 2018 8:15 am
cars: 1948 GMC
Location: Fort Collins, Colorado

USB BDM NT

Post by DavidBraley »

After doing this, I'm not sure it was worth the time.

But in case it's of any interest, I read the contents of a 0411 with PCMHammer version 4, and then read the contents of the same 0411 PCM with a USB BDM NT device using a fixture I built to do so. It was PeteS who exposed me to this device in a post. My original motive was to see if the contents of the two bin files where the same. I used a tool called HexCmp2 (Antus inspired) to make the comparison. According to HexCmp2, both bins where exactly the same. I just remove the 0411 lid to access the rear side of the main board to read and write. Not practical for sure, but fast as hell. Full 512K read in less than 3 seconds. Full 512K erase and then write in less than 38 seconds. I was careful to keep the lead lengths (including probe pins) to less than 6 inches (152mm).
Attachments
bdm5.jpg
bdm5.jpg (314.43 KiB) Viewed 10312 times
bdm4.jpg
bdm4.jpg (281.96 KiB) Viewed 10312 times
bdm1.jpg
bdm1.jpg (290.56 KiB) Viewed 10312 times
-David

I'm a machinist... because engineers need heroes too.
User avatar
Holden202T
Posts: 10311
Joined: Sat Feb 28, 2009 9:05 pm
Location: Tenambit, NSW
Contact:

Re: USB BDM NT

Post by Holden202T »

yeah thats certainly looks like far too much effort, but the results are good and prove what you wanted.
User avatar
Gampy
Posts: 2331
Joined: Sat Dec 15, 2018 7:38 am

Re: USB BDM NT

Post by Gampy »

That's sexy ... uh huh.

-Enjoy
: )_~
Intelligence is in the details!

It is easier not to learn bad habits, then it is to break them!

If I was here to win a popularity contest, their would be no point, so I wouldn't be here!
User avatar
NSFW
Posts: 679
Joined: Fri Feb 02, 2018 3:13 pm

Re: USB BDM NT

Post by NSFW »

How many bricked PCMs would you need to resuscitate before the investment would be worthwhile? I'm guessing... two? But I don't know how much work went into it. It's a really cool piece of hardware, regardless.

Where did you get the probe pins?

Do you think a 3D printer could make something equivalent for less money and effort?
Please don't PM me with technical questions - start a thread instead, and send me a link to it. That way I can answer in public, and help other people who have the same question. Thanks!
bubba2533
Posts: 498
Joined: Wed Apr 11, 2018 8:50 am
cars: 03 Chevy S10 Turbo V6

Re: USB BDM NT

Post by bubba2533 »

I did the same thing with a P59. Only difference is that I took a shortcut and soldered mine directly to the board. I still need to use PCM Hammer to read and verify they are the same.
LS1 Boost OS V3 Here. For feature suggestions post in here Development Thread. Support future development ->Patreon.
User avatar
DavidBraley
Posts: 172
Joined: Thu Jun 07, 2018 8:15 am
cars: 1948 GMC
Location: Fort Collins, Colorado

Re: USB BDM NT

Post by DavidBraley »

Thanks everyone, and yes it was a lot of effort. But I have a tendency to put more work into things than they really need. Sorry if this post is a little long...

NSFW,

The pins come in a lot of different sizes, so choose ones that you think will work for your design. These are the exact ones I used:

https://www.ebay.com/itm/100x-P100-B1-1 ... rk:13:pf:0

I personally think you could 3-D Print a fixture that would work.

I found implementing the BDM NT device to be much harder than I was expecting. I spent more time figuring out how I would do this and how to actually get it to work then it too me to make the fixture. I've spent the last 40+ years as a precision machinist, welder and fabricator. So typically when I need to play with electrons, or manipulate a line of software code or a system config file, I really am out of my element. I think the only reason I eventually stumble through projects like this is my ability to pay attention to details. Something that you learn how to do really well as a machinist.

I chose to make the fixture universal because I do not know where this "Playing with EFI" is going to take me. I may use it to program other engine computers in the future. Probably the simplest way to use the USB BDM NT device is to wire the ribbon cable directly to the PCM like PeteS did. MUCH simpler for sure.

For my project, I didn't want to do it this way. Instead, I made the part that holds the test probe pins separate, and it just bolts to the cross-bar of the programming fixture:
bdm8.jpg
bdm8.jpg (299.54 KiB) Viewed 10264 times
Before I started this project, it would have been very helpful to me if I knew these three things that are not included in the existing BDM NT documentation:

First, I learned (the slow and hard way) that it's super critical to keep the lead length from the BDM NT device as short as possible. Otherwise, you will be reading and writing junk.

Second, the USB BDM NT device does have three configurable speeds. <Speed>0</Speed> sets the device to 6mhz, <Speed>1</Speed> sets the device to 3mhz, and <Speed>2</Speed> sets the device to 1.5mhz. These can be set in the .xml config file for the target you are reading and writing to.

Third, I also learned that the programming pin WPP that the USB BDM NT documentation talks about is actually the Vpp pin on the Intel Flash AB28F400B5 memory chip. This pin needs to be pulled up to something higher than 11.4 volts for an erase or write to work correctly. But what the existing BDM NT instructions don't tell you is it actually has a maximum voltage you shouldn't exceed. I discovered this in the datasheet for the Intel flash memory chip. The data sheet specifies that Vpp needs to be somewhere between 11.4 volts dc and 12.6 volts to correctly work. This higher pin voltage (between 11.4-12.6) is only needed when doing an erase or write to the flash memory. The existing BDM NT documentation states to put something like a 100 ohm resistor in series to the pin, but I found this not helpful in my case. So I implemented a variable resistor (potentiometer) in my programming cable.

I built my programming cable to have these features. On one end is the voltage input to the cable (I use a 13 volt supply). It has a safety fuse (1 amp) and a voltage meter so I know what the cable is being feed. This input voltage is controlled through a switch that sends it to pins 19 (ignition) and 20 (battery) on the blue connector. I also feed ground to pin 60 on the blue connector.
bdm10.jpg
bdm10.jpg (288.55 KiB) Viewed 10264 times
The other end of the cable has the blue connector cable output, another switch for sending 12 volts to the Vpp pin for erasing and writing. It also has a voltage meter so I know exactly what voltage the Vpp is getting.
bdm11.jpg
bdm11.jpg (290.67 KiB) Viewed 10264 times
I mention earlier that I put a trim pot inside the programming cable I made so that I could adjust the voltage at pin Vpp to 12 volts. I use a .75 watt, 15 turn pot for this. It's located on the side of the black programming cable case. Access is with a very small screwdriver.
bdm12.jpg
bdm12.jpg (338.13 KiB) Viewed 10264 times
Anywho, sorry again for the long length of this post. I hope this information helps others who try to do this.

David
Last edited by DavidBraley on Mon Feb 11, 2019 11:50 am, edited 2 times in total.
-David

I'm a machinist... because engineers need heroes too.
User avatar
DavidBraley
Posts: 172
Joined: Thu Jun 07, 2018 8:15 am
cars: 1948 GMC
Location: Fort Collins, Colorado

Re: USB BDM NT

Post by DavidBraley »

I think I was not completely clear about something in my last post. I use both the USB BDM NT device and what I call my programming cable above at the same time when I read and write to the PCM.

Take care,

David
-David

I'm a machinist... because engineers need heroes too.
User avatar
antus
Site Admin
Posts: 8237
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: USB BDM NT

Post by antus »

Nice piece of hardware, thanks for documenting and posting! Interesting about the voltage. I know vpp has limits but when switching that voltage in software (flash kernel dev work for pcmhammer) its regulated by the pcms internal supply so you get that for free. I had incorrectly assumed the resistor was part of triggering bdm mode and had not made the connection to it being a rudimentary substitute for voltage regulation. The guy on here who tested flashing with pcmhammer at 16v would definitely have problems doing it this way.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
User avatar
DavidBraley
Posts: 172
Joined: Thu Jun 07, 2018 8:15 am
cars: 1948 GMC
Location: Fort Collins, Colorado

Re: USB BDM NT

Post by DavidBraley »

Something else that might be of interest, on some of the 1meg Blue/Green PCM's like the 2004 12586242 and 12586243, they use the AMD AM29F800BB flashchip. This chip doesn't have a pin that needs a higher voltage for erase and write. You can read, write and erase without it.

A lot of the pad locations on the back of the main board on these 1 meg PCM's is the same as the 0411. I was able to read the 1meg 12586243 PCM I have here with the BDM NT and view it's file in TunerPro RT. But I can't erase or write to it yet. The .xml file doesn't seem to work properly. But the fixture I built and the probe attachment that I use on the 0411 seems to be compatible with the Blue/Green 1 meg PCM. I just don't hook up the 12 volt programming line.
-David

I'm a machinist... because engineers need heroes too.
User avatar
antus
Site Admin
Posts: 8237
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: USB BDM NT

Post by antus »

Thats interesting. The unlock and flash procedure is definitely different from the AMD flash, and the 12V is only required to enable the flash memory's internal state machine for erase and programming so this is why you dont need it to read. The chips are in read mode by default at power on. Having said that there are 2 ways to involk the state machine on the AMD chip. It seems to be really touchy about getting that mode going. I havnt been able to get it in to that mode despite doing what the data sheet says so far. Not sure if its a bug of mine, timing issue, or what yet.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
Post Reply