How to update/change firmware of Focus/Kuga CMR module?

[Go4IT]

Hi guys! I've got a Focus camera module but it only provides picture, no "lines". It also refuses to communicate through CAN in a way we know it from Mondeo. The question is how to connect to it? I've already tried to use UCDS in "Focus MK3" mode, but it didn't find the module either.
The most important question for me was: how to upgrade to firmware to a Mondeo one to make this kind of modules also usable for this type of car?
I know that hardware inside is perfectly the same. Focus uses a special steering angle sensor, directly connected to the module, whereas Mondeo uses CAN-messages.

I thought to somehow clone the firmware on MCUs internal Flash, but for shure it's read protected. And the firmware available from the update-files never contains bootloader and bootvectors. The MCU is a "MC9S12DG128", which is often used in automotive modules. It has no external RAM, Flash or EEPROM. Maybe there is a chance to download by using JTAG, but it would be hard as i'm pretty shure it's readout protected this way.

[DGAlexandru]

This is Focus 2 / Kuga, not Focus 3.
Focus 3 PreFacelift uses different hardware which is only for CAN to LIN and also power for Rear Camera. The Video signal is delivered directly from Camera to Front Display. The latter one also adds those lines.

Usually on Fords this Motorola (FreeScale) 912 or 9S12 family MCUs are not protected... even in RKM / KVM modules they are unprotected.
You need a Motorola 912 / 9S12 BDM programmer. I have one from ETL.. but there are plenty of clones out there for about 50Eur. You can also use XProg.

I have a Mondeo 4 one - 9M2J-19H405-AD, maybe I'll have some time to dump its FirmWare.

IMG_20210806_104433.jpg

[Go4IT]

This is Focus 2 / Kuga, not Focus 3.

This is where you are right

Focus 3 PreFacelift uses different hardware which is only for CAN to LIN and also power for Rear Camera. The Video signal is delivered directly from Camera to Front Display. The latter one also adds those lines.

This is where i disagree. The hardware, means of the electronics, is EXACTLY the same on all those devices, regarless if they where uses in different types of Fords. The only difference is the firmware. I've attached some pictures where you can see yourself.

And also the Focus has had the ability to show lines, but it does not use CAN-messages from steering column but a separate steering angle module which was attached additionally behind the wheel. The wires are directly fed into the module.

[Go4IT]

As you say the MC9S12 series of MPUs (aka "HCS12") uses BDM (Background Debug Module) instead of JTAG. I'm pretty shure this is the BDM-Header of the CMR-Board:

cmr_bdm_header.png

The manual says:

Code: Select all

4.3 Security
The device will make available a security feature preventing the unauthorized read and write of the
memory contents. This feature allows:
• Protection of the contents of FLASH,
• Protection of the contents of EEPROM,
• Operation in single-chip mode, No BDM possible
• Operation from external memory with internal FLASH and EEPROM disabled.
The user must be reminded that part of the security must lie with the user’s code. An extreme example
would be user’s code that dumps the contents of the internal program. This code would defeat the purpose
of security. At the same time the user may also wish to put a back door in the user’s program. An example
of this is the user downloads a key through the SCI which allows access to a programming routine that
updates parameters stored in EEPROM.

[Go4IT]

I measured out the header and it is this connected:

mc9s12_qfp80_pinout.png

Which leads to a header-pinout of (seen from top of PCB):

cmr_bdm_header.png

[Go4IT]

I've bought one of those cheap BDM-clones from China:

IMG_6500.JPG

IMG_6501.JPG

I looks like it uses itself a MC9S, but i would be surprised if this was a genuine chip

IMG_6502.JPG

If they somewhat comply to the standard, the header should have this pinout:

bdm_header_6pin.png

[Go4IT]

So, for shure, the MODA/MODB needs to be set according to the action requested. The operation mode is detected on chip boot by state of
BKGD, MODA and MODB which is 1, 0, 0 because of the pullups/pulldowns on the board:

operation_mode.png

So operation mode is "Normal Single Chip, BDM allowed" - surprise, surprise

[Go4IT]

@DGAlexandru, what software should i use to try to dump the contents of the MC9S12 internal flash and eeprom?

[DGAlexandru]

Focus 3 PreFaceLift, again, has nothing to do with Focus 2. It's more like the next step of Mondeo 4 architecture.
The RVC module is used only for power and LIN to camera. The RVC communicates by MS-CAN with the rest of the car modules. For Focus 3 FaceLift, this RVC dissapeared and the LIN to the camera is from BCM.

Regarding software, each interface uses its own software. I've never used the one you have, but it seems to be a clone after an OEM Motorola / FreeScale interface so go and see what FreeScale offers.

[Go4IT]

My first readout attempt with USBDM (Clone) and OpenSource usbdm project software was a fail. Besides the suite does not contain a tool to readback flash/eeprom only memory, it can't detect or connect to the CPU.