T43 reflash fail

[dzidaV8]

Here's the log from the second flash and ecu info read.
I just mentioned the radio fuse as SPS says it needs to be removed.

[dzidaV8]

All mode 36 data transfers are to the address 0x003F, shouldn't it change with every request?
I thought 24242068 is the bootloader, but there is no 36 80 request to download and execute, only download requests. So that would mean there is bootloader in flash, then what is the 24242068?

[ironduke]

All mode 36 data transfers are to the address 0x003F, shouldn't it change with every request?
I thought 24242068 is the bootloader, but there is no 36 80 request to download and execute, only download requests. So that would mean there is bootloader in flash, then what is the 24242068?

Bootloader is written to 3F AF E0 for the first segment and that does increment.
1st segment starts at 0x3fafe0 for 0xc20 bytes.
2nd segment starts at 0x3fbc00 for 0x400 bytes.
Those 2 segments are the write kernel..
Once the writer kernel is loaded and executed it then sends the OS and cal files to 0x3FC000 and that does not increment.
Honestly not sure how that works but I've been able to copy it with my own code and it works..
Both segments are in the utility file along with the write addresses and size.
I've looked at the logs, not sure what's going on.
The last log you posted before programming it shows it reported E2 for programming state which I believe is OS present but cals missing.
At the end after programming it reports E0 which means fully programmed.. I am assuming your turning the ign off when programming is done for 30 seconds or so?

I am assuming it's setting a P60? something code??

[dzidaV8]

I have cycled ignition after programming, but probably with not that long off time. I'll try that.

Strange that GMW3110 says byte width of memory size in service 34 and starting address in service 36 should be the same. Log shows 2B memory size and then 4B starting address, and no 0x80 subfunction to execute the loader... GM does not follow their own standards?

DTC is P0601 IIRC

[ironduke]

I have cycled ignition after programming, but probably with not that long off time. I'll try that.

Strange that GMW3110 says byte width of memory size in service 34 and starting address in service 36 should be the same. Log shows 2B memory size and then 4B starting address, and no 0x80 subfunction to execute the loader... GM does not follow their own standards?

DTC is P0601 IIRC

As far as needing the 0x80 for execution I don't always see it, I guess they don't follow the standards all the time which sounds like that happens a lot, lol..
The size in the service 36 isn't shown, hadn't really noticed with those logs but it looks like ISO15765 is turned on and not shown.
The length byte is missing, when I send ISO15765 that's what the command looks like but the Jtool sends something else slightly different, wouldn't worry about that.
Below is a snippet of a log directly from the canbus RAW with no formatting.

101FE013E0000000000
7E20227010000000000
7EA046701B3D8AAAAAA
7E204270284DA000000
7EA026702AAAAAAAAAA
7E2053400000C200000 // Sending 0xC20 bytes
7EA037F3478AAAAAAAA
7EA0174
7E21C263600003FAFE0 // Sending 0xC26 bytes, 6 bytes for 36 command and addressing = sending 0xc20 bytes
7EA300001
7E221003FB000003FB0
7E222C0FFFFFFFFFFFF
7E223FFFFFFFFFFFFFF
7E224FFFFFFFFFFFFFF
7E225FFFFFFFF9421FF
7E226E07C0802A6BFA1

Not sure how long the ign has to be off, just that if it has some bookkeeping to run for eeprom that is when it does it. I say 30 seconds but that's just repeating others. I know vin writes don't stick if you don't..

[kur4o]

There is only erase/write code uploaded to tcm, no execution is done. The main loop that communicates is within boot segment that is not flashed.
Only OS and caldata is flashed.

There is 2 options, either diablo bricked the bootblock with some programming attempt or it bricked the eeprom somehow, but this don`t have checksums as long as I know.

To proceed you will need to find a way to read full tcm , if all looks good than it tcm is toast internally and needs changing.

What j-devices you have on hand, can you get mdi somewhere. We can do some loop dump with mode23.

[Tazzi]

The only couple of exceptions here I can think of, is if the boot section has been modified, or if the boot section and OS/cals are not a compatible pair which can also cause an issue.

[dzidaV8]

OK, went back and reflashed it again with DPS, waited a minute with ignition off and requested ECU info again.

tcm 2.png

With standard request it shows 00 - fully programmed.

But I still get DTC P0601-00 from TCM.

CVNs all match values from tis2web:

cvns.png

Maybe I could try reading it with HPT, but IDK if it reads the full flash?

For tools I have HPT, VXdiag, AVT-842, OBDlink MX+, Tech2 and Canable...

[ironduke]

I'm drawing a blank, sorry.
If you have hpt go ahead and read it and please either post it here or pm a copy. It will read the whole 2mb of flash but it will need to be converted to a .bin.
I'm curious on the boot segment and the checksum and CVN of that..
Something weird is going on past my knowledge, looking like the tcm is going to need to be replaced, possible to fix with something like IO prog if something is wrong with the boot segment.

[Tazzi]

Oh oh oh, I can across something the other day and made me think of this thread.

So if the MCVM data (Mechanical Characterization and Virtual Matching) is corrupted or blanked, it can throw a 601 error.

Might need to perform the config and setup option in techline to program the correct MCVM data into the unit. It is technically just basic DID writes with some default data to suit that specific TCM and vehicle combo.

*Edit
Nevermind, the above was only for the newer style TCMs, not T43.

I do know if I cross flash an OS/Cals from a newer T43 into an older T43 (different hardware numbers), it does result in P0601 errors also.