Page 2 of 6
Re: Bricked Pam
Posted: 16 Jan 2020, 15:33
by Stevebe
Ursadon wrote: ↑16 Jan 2020, 15:24
Maybe PAM stuck at bootloader. This is easy to verify if you have ELS27 cable.
1. Download Br@y++ terminal
https://sites.google.com/site/terminalbpp/
2. connect to your ELS27.
3. send AT commands:
AT ST 53 (to change baud and can mode) and
AT SH 736 (to change dst address)
4. Press "Set macros button" and put this to first macro:
1002#013#010%DLY0030
this macro send
10 02 (
startDiagnostincSession for program download) with CR and LF every 30ms
5. Set delay to 10 or 30 ms
6. Check chekbox right after macro definition to start autorepeat this command
7. Examine log - if your see "STOPPED", then module is really dead. If you see some hex output - then you can recover it
8. Also: try to power-off and power-on device several times, while terminal sends a macro
Thank I’ll give it a try
Tried it all i got was stopped
Re: Bricked Pam
Posted: 18 Jan 2020, 00:41
by Gwe89
Stevebe wrote: ↑16 Jan 2020, 15:33
Ursadon wrote: ↑16 Jan 2020, 15:24
Maybe PAM stuck at bootloader. This is easy to verify if you have ELS27 cable.
1. Download Br@y++ terminal
https://sites.google.com/site/terminalbpp/
2. connect to your ELS27.
3. send AT commands:
AT ST 53 (to change baud and can mode) and
AT SH 736 (to change dst address)
4. Press "Set macros button" and put this to first macro:
1002#013#010%DLY0030
this macro send
10 02 (
startDiagnostincSession for program download) with CR and LF every 30ms
5. Set delay to 10 or 30 ms
6. Check chekbox right after macro definition to start autorepeat this command
7. Examine log - if your see "STOPPED", then module is really dead. If you see some hex output - then you can recover it
8. Also: try to power-off and power-on device several times, while terminal sends a macro
Thank I’ll give it a try
Tried it all i got was stopped
I already said the latest ucds has messed up the dead module programming so use your clone I did this with a pam I bricked and recovered it with no problems had genuine one sending ignition data then clone setup to program the right firmware when it asks to turn power off to the module and power it back on the second I powered it back on it started loading the fw, genuine ucds is crap with this latest update
The auto pam you loaded only programs one of the 8 blocks so it wont be dead
Re: Bricked Pam
Posted: 18 Jan 2020, 01:29
by Stevebe
Clone can’t recover either says same can’t retrieve hardware info. I have tried most all
Re: Bricked Pam
Posted: 19 Jan 2020, 00:41
by Go4IT
If the module is not programmable, it does not react on CAN messages, no matter what you play around with software or interfaces. You already find out that it does not work, so you need to find another way to recover the Flash. There is of course a JTAG but a procedure is needed to rewrite it. Also you need the bootloader part, which is most likely not part of the update file available from Ford...
Re: Bricked Pam
Posted: 19 Jan 2020, 01:02
by DGAlexandru
There is BDM, not JTAG
We have the entire Flash dump files here on forum.
Re: Bricked Pam
Posted: 19 Jan 2020, 02:23
by Stevebe
DGAlexandru wrote: ↑19 Jan 2020, 01:02
There is BDM, not JTAG
We have the entire Flash dump files here on forum.
Yes I did see BDM port I need to find if it is available on the rear pin outs.
FB200AFE-648B-40B2-BB2D-966177E704F8.png
3FA9C574-3498-42F1-B75C-870F03BDA9C6.png
I do have a BDM unit with software but I need win7 to run and it won’t work on a VM. Si i have put together a PC MADE UP OF ODDS N SODS. ILL Get win 7 INSTALLED and see what goes.. thanks for all you help guys
Re: Bricked Pam
Posted: 19 Jan 2020, 06:57
by DGAlexandru
Usually BDM port is present on PCB as 6 "dots" - 3 colums x 2 rows.
Re: Bricked Pam
Posted: 19 Jan 2020, 10:34
by Go4IT
Yes, you're right guys, it's BDM. steveb did you measure out the MOD-pins to know what operating mode we have?
For our sake the designers of the PCB supported two sizes of the chip and soldered the smaller one, so we have excellent measurepoints there to hijack signals
But i would also suspect those pads to be BDM...
bs7t-15k866-ae_pcb-top_explained.jpg
Re: Bricked Pam
Posted: 20 Jan 2020, 17:57
by Stevebe
BDM requires
D36AE585-9FEB-4E5D-BE8A-701FBE723CDC.jpeg
But can’t find pin out on MCU
564A25C1-2920-4BF8-9DBE-65BAE933DB81.jpeg
948C62B3-98A0-4EF4-83B1-03E440BFF38D.jpeg
Re: Bricked Pam
Posted: 20 Jan 2020, 18:04
by DGAlexandru
Motorola BDM is with BKGD, GND, RESET, VDD:
DG128_80OFP.jpg
I use something from ETL (yes, old and limited HC912 / HC9S12 MCUs):
e912prog.pdf