Ursadon wrote: ↑16 Jan 2020, 15:24
Maybe PAM stuck at bootloader. This is easy to verify if you have ELS27 cable.
1. Download Br@y++ terminal https://sites.google.com/site/terminalbpp/
2. connect to your ELS27.
3. send AT commands: AT ST 53 (to change baud and can mode) and AT SH 736 (to change dst address)
4. Press "Set macros button" and put this to first macro: 1002#013#010%DLY0030
this macro send 10 02 (startDiagnostincSession for program download) with CR and LF every 30ms
5. Set delay to 10 or 30 ms
6. Check chekbox right after macro definition to start autorepeat this command
7. Examine log - if your see "STOPPED", then module is really dead. If you see some hex output - then you can recover it
8. Also: try to power-off and power-on device several times, while terminal sends a macro
Thank I’ll give it a try
Tried it all i got was stopped
Ursadon wrote: ↑16 Jan 2020, 15:24
Maybe PAM stuck at bootloader. This is easy to verify if you have ELS27 cable.
1. Download Br@y++ terminal https://sites.google.com/site/terminalbpp/
2. connect to your ELS27.
3. send AT commands: AT ST 53 (to change baud and can mode) and AT SH 736 (to change dst address)
4. Press "Set macros button" and put this to first macro: 1002#013#010%DLY0030
this macro send 10 02 (startDiagnostincSession for program download) with CR and LF every 30ms
5. Set delay to 10 or 30 ms
6. Check chekbox right after macro definition to start autorepeat this command
7. Examine log - if your see "STOPPED", then module is really dead. If you see some hex output - then you can recover it
8. Also: try to power-off and power-on device several times, while terminal sends a macro
Thank I’ll give it a try
Tried it all i got was stopped
I already said the latest ucds has messed up the dead module programming so use your clone I did this with a pam I bricked and recovered it with no problems had genuine one sending ignition data then clone setup to program the right firmware when it asks to turn power off to the module and power it back on the second I powered it back on it started loading the fw, genuine ucds is crap with this latest update
The auto pam you loaded only programs one of the 8 blocks so it wont be dead
If the module is not programmable, it does not react on CAN messages, no matter what you play around with software or interfaces. You already find out that it does not work, so you need to find another way to recover the Flash. There is of course a JTAG but a procedure is needed to rewrite it. Also you need the bootloader part, which is most likely not part of the update file available from Ford...
DGAlexandru wrote: ↑19 Jan 2020, 01:02
There is BDM, not JTAG
We have the entire Flash dump files here on forum.
Yes I did see BDM port I need to find if it is available on the rear pin outs.
FB200AFE-648B-40B2-BB2D-966177E704F8.png
3FA9C574-3498-42F1-B75C-870F03BDA9C6.png
I do have a BDM unit with software but I need win7 to run and it won’t work on a VM. Si i have put together a PC MADE UP OF ODDS N SODS. ILL Get win 7 INSTALLED and see what goes.. thanks for all you help guys
You do not have the required permissions to view the files attached to this post.
Last edited by Stevebe on 19 Jan 2020, 17:44, edited 1 time in total.
Yes, you're right guys, it's BDM. steveb did you measure out the MOD-pins to know what operating mode we have?
For our sake the designers of the PCB supported two sizes of the chip and soldered the smaller one, so we have excellent measurepoints there to hijack signals But i would also suspect those pads to be BDM...
bs7t-15k866-ae_pcb-top_explained.jpg
You do not have the required permissions to view the files attached to this post.
