2004 Baja MT

[MiikaS]

Well that's odd. Need to check with my bench ECU what's going on... It was not long ago when I fixed sh7055 kernels as they was somehow reverted to older version.

[MiikaS]

https://github.com/miikasyvanen/FastECU ... nt/kernels
these?

Yes

no changes.
At the same time ecuflesh and ecuedit write without problems

Tested with 2003 Legacy GT A2ZJ601A ECU. My local repo kernels worked (K-Line and CAN) and then I downloaded kernels from development branch and they worked too... so maybe you copied kernels to wrong place or something else is wrong. When you start read/write it shows path to kernel, make sure you copy kernel to that folder.

[Cortin]

I checked the kernel. Everything is correct.
What else can I check?
I deleted the kernel from the folder to check - it says not found

[MiikaS]

Looking at the error code, I think this could be related to silicon version on sh7055. If it is, this would be the first sh7055 180nm version in Subaru that I'm aware of... need to check more tomorrow.

[Cortin]

if needed, I can connect FastECU-client

[MiikaS]

I checked the kernel. Everything is correct.
What else can I check?
I deleted the kernel from the folder to check - it says not found

Please test kernels from link below. They now have 180nm flash routines and gives error (0x8e) on 350nm MCU when initialising flash mode. Change names by removing "_180" or change kernel names in protocols.cfg to use them. Also prepare to unbrick ECU

Combining these two versions would take some time, so I did quick and dirty fix for testing by building separate kernels.

https://drive.google.com/file/d/15_39jV ... sp=sharing

[Cortin]

write k-line

Code: Select all

[2025-04-10 03:33:13.300] (DD) Response: 
[2025-04-10 03:33:13.308] (II) Different blocks : 10, 15,  (total: 2)
[2025-04-10 03:33:13.308] (II) --- Start writing ROM file to ECU flash memory ---
[2025-04-10 03:33:13.308] (II) Check max message length[2025-04-10 03:33:13.308] (DD) Sent: be ef 00 01 05 b3 
[2025-04-10 03:33:13.312] (DD) Response: be ef 00 05 45 00 00 02 00 f9 
: 0x0200
[2025-04-10 03:33:13.312] (II) Check flashblock size[2025-04-10 03:33:13.312] (DD) Sent: be ef 00 01 06 b4 
[2025-04-10 03:33:13.317] (DD) Response: be ef 00 05 46 00 00 10 00 08 
: 0x1000
[2025-04-10 03:33:13.317] (II) Test write mode off, perform actual flash write
[2025-04-10 03:33:13.317] (DD) Sent: be ef 00 01 20 ce 
[2025-04-10 03:33:13.321] (DD) Response: be ef 00 01 60 0e 
[2025-04-10 03:33:13.321] (EE) Flash mode succesfully set
[2025-04-10 03:33:13.321] (II) Flash block addr: 0x00020000 len: 0x00010000
[2025-04-10 03:33:13.322] (II) Check flash voltage[2025-04-10 03:33:13.322] (DD) Sent: be ef 00 01 04 b2 
[2025-04-10 03:33:13.326] (DD) Response: be ef 00 05 44 02 30 02 30 5a 
: 11.2V
[2025-04-10 03:33:13.326] (II) Flash page erase addr: 0x00020000 len: 0x00010000
[2025-04-10 03:33:13.326] (II) Erasing flash page...[2025-04-10 03:33:13.326] (DD) Sent: be ef 00 05 25 00 02 00 00 d9 
[2025-04-10 03:33:16.332] (DD) Response: 

[2025-04-10 03:33:16.333] (EE) No valid response from ECU
[2025-04-10 03:33:16.333] (EE) Reflash error! Do not panic, do not reset the ECU immediately. The kernel is most likely still running and receiving commands!
[2025-04-10 03:33:16.333] (II) Block 10 reflash failed.

[Cortin]

wrtite can.
brick ECU
erased area 20000-30000
But didn't record anything

Code: Select all

2025-04-10 03:42:17.596] (DD) Response: 
[2025-04-10 03:42:17.601] (II) Different blocks : 10,  (total: 1)
[2025-04-10 03:42:17.602] (II) --- Start writing ROM file to ECU flash memory ---
[2025-04-10 03:42:17.602] (II) Check max message length[2025-04-10 03:42:17.602] (DD) Sent: 00 00 07 e0 be ef 00 01 05 
[2025-04-10 03:42:17.602] (DD) Response: 00 00 07 e8 be ef 00 05 45 00 00 02 00 
: 0x0200
[2025-04-10 03:42:17.602] (II) Check flashblock size[2025-04-10 03:42:17.602] (DD) Sent: 00 00 07 e0 be ef 00 01 06 
[2025-04-10 03:42:17.603] (DD) Response: 00 00 07 e8 be ef 00 05 46 00 00 10 00 
: 0x1000
[2025-04-10 03:42:17.603] (II) Test write mode off, perform actual flash write
[2025-04-10 03:42:17.603] (DD) Sent: 00 00 07 e0 be ef 00 01 20 
[2025-04-10 03:42:17.604] (DD) Response: 00 00 07 e8 be ef 00 01 60 
[2025-04-10 03:42:17.604] (EE) Flash mode succesfully set
[2025-04-10 03:42:17.604] (II) Flash block addr: 0x00020000 len: 0x00010000
[2025-04-10 03:42:17.604] (II) Check flash voltage[2025-04-10 03:42:17.604] (DD) Sent: 00 00 07 e0 be ef 00 01 04 
[2025-04-10 03:42:17.606] (DD) Response: 00 00 07 e8 be ef 00 05 44 02 30 02 30 
: 11.2V
[2025-04-10 03:42:17.606] (II) Flash page erase addr: 0x00020000 len: 0x00010000
[2025-04-10 03:42:17.606] (II) Erasing flash page...[2025-04-10 03:42:17.606] (DD) Sent: 00 00 07 e0 be ef 00 05 25 00 02 00 00 
[2025-04-10 03:42:17.871] (DD) Response: 00 00 07 e8 be ef 00 01 65 
 erased
[2025-04-10 03:42:17.872] (II) Start flash write addr: 0x00020000 len: 0x00010000
[2025-04-10 03:42:17.872] (DD) Sent: 00 00 07 e0 be ef 02 05 22 00 02 00 00 d2 16 f1 28 f1 f5 8d 
[2025-04-10 03:42:17.891] (DD) Response: 00 00 07 e8 be ef 00 01 62 
[2025-04-10 03:42:17.891] (DD) Data written to flash buffer
[2025-04-10 03:42:17.891] (II) Write flash buffer: 0x00020000 (0% - 14665176 B/s, ~ 14664412 s)
[2025-04-10 03:42:17.897] (DD) Battery: 11.894 V
[2025-04-10 03:42:17.899] (DD) Sent: 00 00 07 e0 be ef 02 05 22 00 02 02 00 93 38 f3 38 92 37 f2 
[2025-04-10 03:42:17.920] (DD) Response: 00 00 07 e8 be ef 00 01 62 
[2025-04-10 03:42:17.920] (DD) Data written to flash buffer
[2025-04-10 03:42:17.920] (II) Write flash buffer: 0x00020200 (0% - 25600 B/s, ~ 3 s)
[2025-04-10 03:42:17.920] (DD) void MainWindow::external_logger_set_progressbar_value(int) 1
[2025-04-10 03:42:17.921] (DD) Sent: 00 00 07 e0 be ef 02 05 22 00 02 04 00 92 6b f2 0a d4 3f d1 
[2025-04-10 03:42:17.941] (DD) Response: 00 00 07 e8 be ef 00 01 62 
[2025-04-10 03:42:17.941] (DD) Data written to flash buffer
[2025-04-10 03:42:17.941] (II) Write flash buffer: 0x00020400 (1% - 18285 B/s, ~ 4 s)
[2025-04-10 03:42:17.942] (DD) void MainWindow::external_logger_set_progressbar_value(int) 2
[2025-04-10 03:42:17.943] (DD) Sent: 00 00 07 e0 be ef 02 05 22 00 02 06 00 c8 80 00 29 70 ff 60 
[2025-04-10 03:42:17.963] (DD) Response: 00 00 07 e8 be ef 00 01 62 
[2025-04-10 03:42:17.963] (DD) Data written to flash buffer
[2025-04-10 03:42:17.963] (II) Write flash buffer: 0x00020600 (2% - 24380 B/s, ~ 3 s)
[2025-04-10 03:42:17.963] (DD) void MainWindow::external_logger_set_progressbar_value(int) 3
[2025-04-10 03:42:17.964] (DD) Sent: 00 00 07 e0 be ef 02 05 22 00 02 08 00 63 51 22 31 61 51 d0 
[2025-04-10 03:42:17.986] (DD) Response: 00 00 07 e8 be ef 00 01 62 
[2025-04-10 03:42:17.986] (DD) Data written to flash buffer
[2025-04-10 03:42:17.986] (II) Write flash buffer: 0x00020800 (3% - 24380 B/s, ~ 3 s)
[2025-04-10 03:42:17.986] (DD) Sent: 00 00 07 e0 be ef 02 05 22 00 02 0a 00 b5 c8 b4 27 00 06 42 
[2025-04-10 03:42:18.006] (DD) Response: 00 00 07 e8 be ef 00 01 62 
[2025-04-10 03:42:18.006] (DD) Data written to flash buffer
[2025-04-10 03:42:18.006] (II) Write flash buffer: 0x00020A00 (3% - 23272 B/s, ~ 3 s)
[2025-04-10 03:42:18.006] (DD) void MainWindow::external_logger_set_progressbar_value(int) 4
[2025-04-10 03:42:18.009] (DD) Sent: 00 00 07 e0 be ef 02 05 22 00 02 0c 00 88 01 8d 02 00 09 a0 
[2025-04-10 03:42:18.029] (DD) Response: 00 00 07 e8 be ef 00 01 62 
[2025-04-10 03:42:18.029] (DD) Data written to flash buffer
[2025-04-10 03:42:18.029] (II) Write flash buffer: 0x00020C00 (4% - 25600 B/s, ~ 3 s)
[2025-04-10 03:42:18.029] (DD) void MainWindow::external_logger_set_progressbar_value(int) 5
[2025-04-10 03:42:18.031] (DD) Sent: 00 00 07 e0 be ef 02 05 22 00 02 0e 00 c8 08 8f 29 fd 8d d1 
[2025-04-10 03:42:18.052] (DD) Response: 00 00 07 e8 be ef 00 01 62 
[2025-04-10 03:42:18.052] (DD) Data written to flash buffer
[2025-04-10 03:42:18.052] (II) Write flash buffer: 0x00020E00 (5% - 22260 B/s, ~ 3 s)
[2025-04-10 03:42:18.052] (DD) void MainWindow::external_logger_set_progressbar_value(int) 6
[2025-04-10 03:42:18.053] (II) Flash buffer write complete... 
[2025-04-10 03:42:18.053] (DD) Image CRC32: 0xe2eba374
[2025-04-10 03:42:18.053] (II) Committ flash addr: 0x20000 len: 0x1000 crc32: 0xe2eba374
[2025-04-10 03:42:18.053] (DD) Sent: 00 00 07 e0 be ef 00 0b 24 00 02 00 00 10 00 e2 eb a3 74 
[2025-04-10 03:42:21.057] (DD) Response: 
[2025-04-10 03:42:21.059] (EE) No valid response from ECU

[MiikaS]

I think I need to source similar ECU from somewhere for testing. I have now checked registers and all I can think of to make sure it should work. These 180nm and newer chips (sh7055s/sh7058/sh7059) share the same flash erase/write method and I haven't yet found what is the problem also what is strange, that the K-Line and CAN shares same base code, only difference is communication, so they should also act the same...

[Cortin]

another block sh7055
K-line and can - read without problems

[MiikaS]

another block sh7055
K-line and can - read without problems

What is ECU and CAL IDs of this ECU?

[Cortin]

I can't say exactly what ecu id was there. I rewrote it many times.
Experimentally I found out - newer units 22611-AK22X - are not flashed. Their CAL ID is A2WDXXXX.
22611-AH110, 111, 112, 121, 122, 123, 124 - CAL ID - A2ZJXXXX - are flashed.
PS In this case, it doesn't matter what CAL ID is flashed. Everything depends on the unit.

[MiikaS]

I can't say exactly what ecu id was there. I rewrote it many times.
Experimentally I found out - newer units 22611-AK22X - are not flashed. Their CAL ID is A2WDXXXX.
22611-AH110, 111, 112, 121, 122, 123, 124 - CAL ID - A2ZJXXXX - are flashed.
PS In this case, it doesn't matter what CAL ID is flashed. Everything depends on the unit.

I was looking for connection between CAL ID and failed flash. So it seems that when stock CAL ID starts with A2W are with newer 180nm chip. Just to look for ECU to test with.

[Cortin]

if needed, I can connect FastECU-client?

[johnxx]

I have a JDM 2005 Legacy GT ECU (Subaru: 22611AK223, XML ID: A2WD012B). When I try a write or test write with FastECU 0.1.0-beta4 (AppImage on Elementary OS 8 (Ubuntu 24.04)), I get this:

Screenshot from 2025-07-05 19.09.34.jpg (241.88 KiB) Viewed 3791 times

Is this the same issue? If so, is there any useful information I could add grab? And if someone needs an AK22X ECU to play with, I'd be willing to pitch in!