Recover dead/bricked bluetooth module

[Go4IT]

Have anybody of you you guys ever managed to recover (repair) a broken bluetooth module, used for the Sound&Connect feature inside a Ford Focus (2007 onwards) or a Mondeo (2007 onwards) ?

I have two of them here, well in fact three but two really seem to refuse any operation and one missing the bluetooth signal. The ones missing operation draws about 70 mA if connected, but do not send any CAN data, which a module of this type usually do after powerup, regardless of the ignition state on CAN.

The modules are of type 8M5T-19C112-B*

They do not response on DTC reads, nor on radio CAN messages. With UCDS i think it is not possible to recover them anyhow, because somebody told me that those modules have no CAN-bootloader and only can be updated via it's own USB port.

[Go4IT]

I had a looong discussion here in the German electronics-forum about it and find out quite a lot, but not enough to get it up from scratch: https://www.mikrocontroller.net/topic/475276

Main problem here is (like everywhere) that only part of the software is freely available, the application, which get's updated via CAN (or USB in this case, because the vendor was too lazy or too dumb to provide an CAN-Updater like all others do). So for a full reflash you miss the bootloader any maybe other vital parts (EEPROMs or data flash areas).

I have one common issue where a module suddenly stops working, maybe because of an faulty upgrade, i don't really know. I have some of those units here at my lab and investigate what's wrong. Found that they not totally dead, they draw a little current (2mA or so). When you short the pins at this tiny device (currently no clue what that part is):

bridge_to_poweron.jpg

found here

area.jpg

The unit seems to powerup then (draws about 60mA), but shuts down after a while. A normal unit will draw about 100mA, so i guess this "brute force" startup is not a way to heal those devices. I think the part i shorted is a tiny switch (mosfet or bjt transistor) and it is controlled by the software, which only activates it under a "good" condiditon.

[Go4IT]

Anyone here who found a method of programming the three Flash-Chips (or at least the one containing the primary/secondary bootloader) with JTAG without the need to desolder them? (Beware that CAN is not an option in this status).

This from the datasheet sounds promissing "The Serial Debug Interface module (SDI module) provides a JTAG-based serial link to an external debugger, for example running on a PC. In addition, the SDI module integrates an on-chip debug module, which allows the user to set up to eight hardware breakpoints on instruction execution and data transfer. The SDI module can act as a CPU bus master to access all memory-mapped resources, such as RAM and peripherals. Therefore it also allows for fast program code download using the JTAG interface"

[Go4IT]

cp3cn37_mcu.jpg

Here are the JTAG pins on at the chip-case:

cp3cn37_jtag_pins.jpg

And these are the JTAG Header pads:

bt-module_jtag-pins.jpg

Pads for determine Boot-Mode (ENV0, ENV1):

env0_env1.jpg

And others:

bt-module_mcu_debug_pins.jpg

Unfortunately there is not further JTAG/Debug information in the datasheet. I found that there once exist an SDK named "CP3-SDK-0" from Texas Instruments, but could not get my hands on it now.

[Go4IT]

Because Segger J-Link does not support National Semiconductor Chips at all, it also has no support for CR16 CompactRISC CPUs. Just to test i choose a generic "RISC V" and get this from J-Flash connect:

Code: Select all

Connecting ...
 - Connecting via USB to J-Link device 0
 - J-Link firmware: J-Link ARM V8 compiled Nov 28 2014 13:44:46
 - Device "RISC-V" selected.
 - Target interface speed: 4000 kHz (Fixed)
 - VTarget = 3.300V
 - ConfigTargetSettings() start
 - ConfigTargetSettings() end
 - TotalIRLen = 8, IRPrint = 0x0001
 - JTAG chain detection found 1 devices:
 -  #0 Id: 0x0FB1501F, IRLen: 08, Unknown device
 - ConfigTargetSettings() start
 - ConfigTargetSettings() end
 - TotalIRLen = 8, IRPrint = 0x0001
 - JTAG chain detection found 1 devices:
 -  #0 Id: 0x0FB1501F, IRLen: 08, Unknown device
 - ERROR: CPU-TAP not found in JTAG chain
 - ERROR: Failed to connect.
Could not establish a connection to target.

The JTAG-ID seems good, but as J-Flash has no support for it, it also lacks a download-code for the Flash...

[Go4IT]

Next try was to use UCDS. When i look at the update files there is for exampl "8M5T-14D511-BU.vbf", which looks promissing:

Code: Select all

vbf_version = 2.2;

header {
    //**********************************************************
    //*
    //*                  Volvo Car Corporation
    //*
    //*     This file is generated by VBF CONVERT ver. 3.1.7
    //*
    //*                        DO NOT EDIT !
    //*
    //**********************************************************

    // Volvo software part number
       sw_part_number = "8M5T-14D511-BU";

    // Volvo software part type: Executable
       sw_part_type = EXE;

    // Network: CAN medium speed main network
       network = CAN_MS;

    // main node with ECU description: 
       ecu_address = 0x772;

    // 11-bit CAN identifiers
       frame_format = CAN_STANDARD;

    // Erase information
    //         start,     length
       erase = { 
        { 0x00000000, 0x006D5C16 }
       }; 

    // Blocks:   1
    // Bytes:    7166998

    file_checksum = 0x8893D3A7;
}

But when i try to add this to UCDS VBF-Loader it get an "Out of memory" error:

[DGAlexandru]

It is because it isn't a standard VBF file.. even if looks like one.
It is described as one block of data, but instead there are 6 or 7 (or more, I don't remember now).

[Go4IT]

Thanks. That's strange, isn't it?! Because what i've read about the MCU is that it is capable of CAN and so maybe offers update via CAN...