(SOLVED!) How to read and write mainboard Flash (Spansion S29GL)

[oscarboiro]

I need unmount pcb to test this points, when i need test this point? before, during and after try to write?

[Go4IT]

Just an update on reading from my faulty NX. I suspected the RAM chips to be faulty, also they look "strange" to me, like somebody had replaced them before and the markings don't looked geniune. So i replaced them with original RAM chips, and the unit came up instandly!

Next it try to re-read the flash again, and this time it read the whole content in one go, without aborting. This means that if reading the flash results in aborts (shure, with /SEL set to GND), it may be caused of faulty RAMs. If you encounter such problems, try to change the RAM chips first.

Unfortunately the 20s abort when erasing and writing the flash remains, even with the new RAMs But maybe we can get work this out.

[Go4IT]

I need unmount pcb to test this points, when i need test this point? before, during and after try to write?

Yes you need to complety remove the mainboard to gain access to the TPs. What i suggest is to use an DSO and set a trigger (falling edge) on it. Then try to read or erase, start the DSO-trigger-watch until the abort happens. If the trigger does not raise, go to the next TP.

[oscarboiro]

Good Morning.

Today i unmount the PCB and try to erase and test points. This is the result:

PCB test points.jpg

Show the error message at the same time of decrease power.

Another test points to read?

[Go4IT]

Hey @Stevebe, i've burned your NX image just for fun onto one of my test devices. Look what i've get after powering it on:

nx_please_insert_download_data_carrier.jpg

Then i inserted an Nav-DVD into the drive, and this i get:

nx_install_dvd_software_2016.jpg

After installing and restarting, the unit starts up just fine:

IMG_2951.JPG

IMG_2956.JPG

Even navigation targets show up:

IMG_2958.JPG

Funny, isn't it? I've place you the mb-dumpfile into your dropbox with the suffix "_fixed". Try to burn it on your NX, i'm excited to see if it runs just fine then!

[Stevebe]

Ok found the fixed version of my file, loaded into a file comparer the difference between them is pretty amazing
It has taken me alright and 20 pages of A4 to make logs of the difference. I can certain see parts on the Nav system
In the working file, this is pretty much what I expected. I’ll try and layout the difference in XL,

how did you get it to burn without timing out ?

[oscarboiro]

Fantastic!!! Good news. I Waith for instructions to try in my unit.

[Go4IT]

I assume that the previous owner of the device had interrupted download (loss of battery power in car) after inserting the nav DVD.

My current way to flash a device is this:
Prepare the unit by putting it into programming mode (/SEL to GND). Also solderering a push button for reset between pin 3 and 5 of the service port pads, where also SEL signal is found.
Setup J-Flash to omitt sector 0 (start with sector 1 and end with sector 511).

Power up the device and press F4 in Segger as shortcut for "Erase entire flash". It starts and after 20 seconds it aborts. Then press and hold the reset button, push F4, put focus on "Yes" button of the dialog that follows using the arrow keys. Now release reset button and hit enter, erasing starts over again. Bit as you see it is much faster now, because the Segger exploit loading into the SRAM of the OMAP checks if the sector needs reflashing and skips real erasing if not. So in the same time (20 secs) it go past the address of the last run. Loop this until all sectors are erased. You find out that inbetween it seems to skip large areas of the Flash. This is ik, since not all sectors are used and empty sectors doesn't need to get erased

Writing the content is similar to that process. First i load the full into J-Flash and delete the range 0x0 to 0x1FFFF, which is the first sector. Again, ensure in project Flash settings of J-Flash sectors for programming are set to 1 - 511 and also under "productional programming" only "program" should be enabled.

Start programming the same way as erasing above. You may find that after a while only a few sectors get written, when always start from the beginning. At this point you should adapt the start sector setting and delete the corresponding range from the beginning of the dump, like done in the first step. E.G. set to start from sector 120, note the start address (e.g. 0x0C8000), delete bytes from 0 to start address minus 1 (e.g. 0x0C7FFFF) and start over.

That's it!

While programming this way i find sometimes the "expecteda aborts are skipped for unknown reason. Yesterday i only need three starts and it programmed right throught. Strange, eh?

[Stevebe]

I assume that the previous owner of the device had interrupted download (loss of battery power in car) after inserting the nav DVD.
e res

Im not certain who your asking but I don’t know the history of this head

[oscarboiro]

Hello.
Today I try to erase my unit, I Follow your instructions and after try some times, finally erase complete.

Later I try to write. I install button to reset and put configuration same of your instructions. But when fail, around 7% I don’t know what range need delete to continue in the next time.

Another question, I made 2 backup:
Travel pilot nx with rear camera and wrong software
Travelpilot nx without rear camera and software ok

If I try to write nx with camera with her backup, write to 7%

But if I try to put backup of nx without rear camera, make a fail in the moment of push write.

I need search nx with rear camera to make a good backup? Or I need modify file to write in another unit?

Thanks! Tomorrow I try more