USB BDM NT

[antus]

Its OK we have done this already. But not gotten results, and I havnt wanted to post the work in progress. Findings in the last 24 horus are:

DS pin is claimed not to be required by the 'connection' diagram in the USBJTAGNT software. So its omission is probably fine. Later I'll test if its needed for P01. It probably isnt.

Next without the 90 pin header we don't have any standard pins we can trust. DWS Stands by his config and mentions that wire length had to be really short for P04. Since I added pigtails to my board I was running longer cables than others. This could be my problem.

Next I compared the pins to the datasheet in the MPC500_M68300_CD_ZIP and some matched, most didnt. I don't know how DWS found the pins if its not the same as that datasheet. All of the pins that go under the cpu package have VIAs through the back of the PCB. Its very fine work and hard to see, but it can be probed out with good light and standing the cpu on the end. Once you have one, the pin next to it is probably the via next to it so you can tack solder a wire on and then carefully probe the CPU pins. The problem is, we have no certain way to know whats what on the CPU pins.

Next step use short jumper wires and test DWS's pins again.

[antus]

Here is my work as I want just to bring you along for the ride and show you how I have attempted it. Its ALL probably wrong, but it's what I have tested so far. Its shows the method, not a good result. No P04s were destroyed tracing these pins.

[darkman5001]

FYI - made a correction to my post on previous page. Also great work on your findings Antus. Even if it is not 100%, it is still research done. Well done mate.

[DWS]

I am the creator of BDM NT and u-Link NT. The init sequence is created based on the firmware and reference manual to
1. Stop watchdog.
2. Initialize the memory read/write so we can detect/erase/program the flash. There are a lot of copy and paste from the original xml and most are harmless and might not be correct. If it works for you then that is good enough.

As of P04, if you cannot find the pinout, then you need to destroy one board by remove the chip and find the trace. This is what I did for E38,E40 and E67.

This is also exactly what I did for P11 too. Thankfully those computers are stupid cheap. Would have been a nightmare to work out the BGA pinout with out pulling the cpu off.

[antus]

I re-wired as per the original diagram. Short cables, no extra connectors. I was getting timeouts, now I get chip id 0000 0000, even at the lowest speed. I have just the pokes documented in the other thread to set up for flash. I am not sure if there is a problem with the pinouts, or something missing from the xml.

Brown is DS, not used, not connected.

Code: Select all

	<Inits>
		<Init>
			<Address>0xFFFA4A</Address>
			<Value>0x6820</Value>
			<Bytes>2</Bytes>
		</Init>
		<Init>
			<Address>0xFFFA4E</Address>
			<Value>0x7020</Value>
			<Bytes>2</Bytes>
		</Init>
		<Init>
			<Address>0xFFFA4C</Address>
			<Value>0x006</Value>
			<Bytes>2</Bytes>
		</Init>
		<Init>
			<Address>0xFFFA48</Address>
			<Value>0x0006</Value>
			<Bytes>2</Bytes>
		</Init>
		<Init>
			<Address>0xFFA03A</Address>
			<Value>0x0000</Value>
			<Bytes>4</Bytes>
		</Init>
	</Inits>

[antus]

DWS took another look at this and found a different XML which he was using with his original pinouts.

I have modified the name of it to suit the type of PCM, and turned the speed up to max since 6mhz is possible with more recent builds of the tool. It is attached here with permission. Its a combination of DWS's work, and the author of USBJTAGNT. I have verified it is working for me

DWS's document is in another thread here viewtopic.php?f=26&t=7637#p120939 , so I'll repost here in the BDM thread to keep it is all together. Credit to him for figuring it out.

Code: Select all

Copyright (C) 2010-2025
USB BDM NT    1.48
Target: ECUP04
-speed 0
-reset 1
Found Address= 00000000 Intel AB28F400B5-B
-getram Code
Time 00:00:01 (.226)

[antus]

Can confirm the instructions here https://www.usbjtag.com/jtagnt/ECU/e40.php for E40 do work for P12.

I made this up as showing the P12 PCB, but the header at the bottom are the same as for the master CPU BDM as described above (I did not test slave CPU BDM as it wasn't needed). The vias are new information. I used the TECU40.xml that is supplied with the app and successfully brought my P12 that wouldnt unlock back to life

This was the smallest soldering i've ever had to do, I did have to use my phone to find shorts I couldn't see between the pins and get it all right. I am not sure the best way to open the back. I unbolted it but the glue held firm, so I hit it with the heat gun but that didnt help, so then I cut around 3 sides with a rotary tool and the peeled the metal I had cut back, and this disturbed it enough that I could keep pulling and get the entire back plate off. Doing it this way is not something you can put back together in a state safe from water egress you could put back in a car, though. But fine for a bench PCM.

I also had a problem with it sort of working but corrupting badly and reading back I couldn't figure out why fragments were missing. It turned out to be a bad connection on the FREEZE line. Sorted that out and it worked properly.

Code: Select all

Copyright (C) 2010-2025
USB BDM NT    1.48
Target: ECUE40
-speed 0
-reset 1
Found Address= 00000000 AM29BL802C
P12 good pcmhammer read.bin loaded
-program Flash
Erase starts...
Erase time 00:00:22 (.968)
Program Starts...
Program speed 124.24 KB/s
Program time 00:00:08 (.441)
Program pass, if no further programming needed, power off/on the target
-reset 1
Found Address= 00000000 AM29BL802C
-getram Flash
Time 00:00:02 (.451)
-cmpram Flash
Time 00:00:02 (.451)
Compare data OK

Code: Select all

[12:10:21:737]  PCM Hammer (22/07/2023, 1:23 PM)
[12:10:21:738]  Sunday, July 23 2023 @12:10:21:73
[12:10:21:926]  AVT 852 Reset OK
[12:10:21:939]  AVT Firmware 1.5
[12:10:23:359]  VIN: 1GNET16S166155178
[12:10:23:459]  OS ID: 12606400
[12:10:23:461]  Hardware Type: P12
[12:10:23:570]  Calibration ID: 12606399
[12:10:23:762]  Serial Number: 5349KH0AS
[12:10:23:872]  Broad Cast Code: YNBD
[12:10:23:969]  MEC: 0
[12:10:28:552]  WARNING: This version uses the new Assembly Kernels, USE AT YOUR OWN RISK!
[12:10:33:415]  Will save to C:\Users\a\Documents\test.bin
[12:10:34:742]  Querying operating system of current PCM.
[12:10:34:842]  OSID: 12606400
[12:10:35:001]  Unlock succeeded.   <---- unlock was not possible before the fix, due to corrupted flash from a failed erase that was caused while developing a kernel.
[12:10:35:067]  Attempting switch to VPW 4x
[12:10:35:116]  Module 0x10 (engine controller) has agreed to enter high-speed mode.
[12:10:38:794]  Kernel upload 100% complete.
[12:10:38:802]  Kernel Version: 8240020C
[12:10:38:804]  Kernel uploaded to PCM succesfully. Requesting data...
[12:10:38:868]  Flash chip: AMD AM29BL802C, 1mb
<snip>

[In-Tech]

Sick

[DWS]

@antus If you run across a short with soldering (people on this side of the world generally call it a solder bridge or just bridge), add some flux and remelt the solder with a clean tip, excess solder will stick to the tip and the two or more solder joints generally clean up quite nicely. One of the ways of soldering chips to a board is to basically drag a ball of solder across the pins and bridges are pretty common and that's the touch up method used. Here's a vid showing even a professional gets them and the process of fixing the issue. With wires of course it's a bit of a challenge. The bridge happens at 1:20

https://www.youtube.com/watch?v=nyele3CIs-U

For opening the computers, I used an oven set to 200F and let it warm up to temp then pry the cover off. Still a lot of work and the cover gets bent and scratched up. I've heard that a blow torch works a lot faster and I guess it works way better. I guess the concept is to get that glue super hot, and the rest of the housing will keep the board from getting too hot.

[Gampy]

AWESOME JOB!

I knew I read it was the same as the E40 ...

-Enjoy