2011 WRX Sti Bricked

[Gmguy]

I was going to try ecu flash recovery mode, but ecu flash will not let me open the rom for the tcu as there are no definitions

It appears though thay will only work with a ftdi chip not a usb-ttl

[MiikaS]

I was going to try ecu flash recovery mode, but ecu flash will not let me open the rom for the tcu as there are no definitions

You can create def file for TCU ROM, need only the ROM header which has info of ROM. You can copy it from ECU def, just change the ECU ID to match TCU ID and then start ECUFlash.

Also, did you test it by swapping tx/rx just to make sure?

[Gmguy]

Yes i tried swapping tx and rx just to see if it made a difference, it just throws an erase timeout.

I dont know what you mean by rom headers or how to change that

But i am going to get a ftdi chip instead tomorrow and try with that, hopefully this one is good enough, way to expensive but the only place i will be able to get one in country before the weekend

https://www.jaycar.co.nz/duinotech-ardu ... eUQAvD_BwE

[MiikaS]

Yes i tried swapping tx and rx just to see if it made a difference, it just throws an erase timeout.

I dont know what you mean by rom headers or how to change that

But i am going to get a ftdi chip instead tomorrow and try with that, hopefully this one is good enough, way to expensive but the only place i will be able to get one in country before the weekend

https://www.jaycar.co.nz/duinotech-ardu ... eUQAvD_BwE

Did it make any connection to MCU when pins swapped? Any log of that?

Header is the first small part in definition file where ROM ID and adresses are defined. In TCU ROM, ID should be at 0x3000 instead of 0x2004 on your ECU ROM. ROM ID address is defined as last two bytes of your ROM. You can look up your ECU definition file from ECUFlash rommetadata directory.

[Gmguy]

No connection, just says trying to erase, erase timer set to 121s, then you wait it out and it comes up no response.

I will have to keep trying tomorrow, is getting late here

I have taken the leads off as the car will not go with no tcm installed and i need to move it in the morning to get it out of the workshop bay

[MiikaS]

No connection, just says trying to erase, erase timer set to 121s, then you wait it out and it comes up no response.

When you say it sets erase timer, did the log say something like this? If yes, then it's connected to MCU, transferred the micro kernel and started flashing procedure but erasing wasn't succesful...

Code: Select all

Clock Frequency (External) = 10.0000MHz, Clock Mode = 0, CKM = 4, and CKP = 2
Connecting to device 'SH7055F' on 'COM8'
Configuration
'BOOT Mode' connection - using emulated interface
Opening port 'COM8' ...
Loading Comms DLL
Loaded Comms DLL
Initiating BOOT SCI sequence
Attempting 9600
Received immediate response from device 0xAA
Using micro-Kernel 'CProgram Files (x86)RenesasFDT4.07kernelsProtB7055Renesas1_0_00uG en7055r.cde'
Downloading and verifying micro kernel...
Device is erasing...
Erase Timeout value set to 21 seconds

Did you apply 12v+GNDs also to TCU connector? I think it also needs those to work correctly. If you soldered wires to TCU PCB, you can do flashing also in car, just put TCU in, power on and flash, done this several times to some ECUs when testing things. Otherwise you need to check wiring diagram to see +12 pins and some GNDs.

[MiikaS]

Checked that TCU ROM and it has TCU ID in address 0x2000 instead of 0x3000 as some others.

And for the header, this should do to make it open in ECUFlash

Code: Select all

<rom>
	<romid>
		<xmlid>WQDE2WB</xmlid>
		<internalidaddress>2000</internalidaddress>
		<internalidstring>WQDE2WB</internalidstring>
		<ecuid>7432744007</ecuid>
		<make>Subaru</make>
		<market>JDM</market>
		<model>Impreza</model>
		<submodel>STi</submodel>
		<transmission>AT</transmission>
		<year>11</year>
		<flashmethod>subarucan</flashmethod>
		<memmodel>SH7058</memmodel>
		<checksummodule>subarudbw</checksummodule>
	</romid>
</rom>

Just save it in rommetadata-folder with some filename as xml file like other definitions and ECUFlash should pick it up when started. Never used SH boot mode in ECUFlash so I don't know if it checks checksums and don't have Windows now to check it up.

[Gmguy]

Yes I had ecu powered and grounded to pins that are recommended in pcmflash module 42 for denso bootloader, their pinouts have always worked for me.

It doesnt have that exact line before setting erase timout, it says something along the lines of no immediate response assume erase in progress

Thank you for that rom data

I will give it a go with fdti chip today as i saw someone else on naisoc say they couldnt get it to work a usb-ttl but it worked with fdti to ttl

[Gmguy]

So trying with ecuflash i get the following

[18:14:17.901] FTDI Driver Version 2.12.36
[18:14:19.744] sending bit rate sync bytes...
[18:14:20.815] no bit rate adjust response
[18:14:20.815] interface close
[18:14:46.639] FTDI Driver Version 2.12.36
[18:14:49.072] sending bit rate sync bytes...
[18:14:49.137] received bit rate adjust response
sending boot command
[18:14:49.663] received bit rate adjust response
sending boot command
[18:14:53.721] received bit rate adjust response
sending boot command
[18:14:57.324] received bit rate adjust response
sending boot command
[18:14:57.850] received bit rate adjust response
sending boot command
[18:14:58.378] received bit rate adjust response
sending boot command
[18:14:58.905] no bit rate adjust response
[18:14:58.905] interface close

And this is with FDT and trying rx and tx pins in opposite positions
OS: Windows 10 (Windows 8) [Non-Admin]
FCF Settings Applied: SH/7058F, (C:\Program Files (x86)\Renesas\FDT4.09\kernels\ProtC\7058\Renesas\1_0_00\)
FDT API initialised: version 4, 09, 02, 000
Initiating BOOT SCI sequence
Attempting 9600
No immediate response from device. Assuming erase in progress...
Device is erasing...
Erase Timeout value set to 241 seconds
Error No 15068: Error while reading timed response
Initiating BOOT SCI sequence
Attempting 9600
Received immediate response from device: 0x00
Attempting 4800
Received immediate response from device: 0xFF
Error No 16183: 0xFF received - Boot Error or Device failed to erase

[Gmguy]

Looks like I finally got it to work!!!

FDT software was a bust, but ECUFlash got it done.

I had made 3 mistakes

1st was not buying an usb fdti at the start.
2nd was not connecting a ground to the fdti even though i was using a seperate 5v feed
3rd was needing to switch the 5v on right as I hit ok for it to write.

Finally got this output from ECUFlash

[18:45:20.809] ending user MAT programming
[18:45:20.809] ending programming
[18:45:20.919] user MAT programming complete
[18:45:20.935] file user MAT checksum is 06DF1511
[18:45:21.204] user MAT checksum is 06DF1511
[18:45:21.204] interface close

Disconnected leads and hooked up to freessm and was able to communicate with TCM on bench. Will reinstall in the vehicle tomorrow and hopefully it goes ok

I will draw up a schematic and post up so if anyone else has this issue they will be able to recover it.

A MASSIVE thanks to MiikaS, rimwall & Cortin without you guys I would of been buying a new TCM

[MiikaS]

Great news!

Was just thinking what else could be wrong and only thing comes to mind is check wirings. Ground is always crucial between devices, otherwise signals are mess.

FDT should work with any adapter which could communicate standard serial speeds. Most of them won't do nonstandard speeds, like what ECUFlash kernels uses. I have many times used some arduino boards to pass serial and WDT signals, even with software serial

But FTDI devices are always the best to buy, they do many things that others don't.

[Gmguy]

Yes, super happy it is working again!

Attached is the wiring diagram of how i pinned it all out and powered it incase anyone else is ever in this situation with one

Denso TCM SH7058S Pinout.jpg (260.2 KiB) Viewed 104493 times

Also need to attach and earth to the earth side of the diode marked 104 ( there is 3 on the board - any should do)

[rimwall]

Nice! Well done!

I am guessing the SHboot command sequence is pretty simple. I wonder if it would be quick thing to add to FastECU?

[Gmguy]

Road tested vehicle this morning and other than the baro sensor being stuck at 149kpa all is good with engine and trans

[Cortin]

baro sensor set a constant value equal to your location