Rfa module differences mondeo mk4 prefl

[amplified]

Hi!
I have exchanged a faulty rfa with keyless entry and start, part number ends in -AC, the new rfa is from car without keyless entry and ends in -BC. Now rfa says u2101 config incompatible and entry doesn’t work. Car starts, unlocks on fob press and all other work.
Is there a difference between rfa/kvm
Modules?

[DGAlexandru]

A* and B* are the oldest ones for Mk4 PreFl
C* and D* are the newer ones for Mk4 PreFl, Mk4 Mid FL and early Mk4 FaceLift.

A* and C* contain relays and other electronic parts that are needed by KeyLess Entry part.
B* and D* are only KeyLess Start.

Techically you can add missing parts to B* and D* to make them A* and C* respectively.

[amplified]

Ahh, bad then…
I tried updating the old rfa and it died in ucds, now it doesn’t want to flash another file. Any way to resurrect it?

[Go4IT]

If you open the KVM and make a picture of the PCB, it might look like this (image took from an 7S7T-19G481-DA):

kvm_7s7t-19g481-da_missing_parts.png

You find the unpopulated parts marked.

To unbrick your device i guess BDM is your friend. It contains a MC9S12 microcontroller and this one has an BDM interface. I wonder if it could be those pads here...

kvm_7s7t-19g481-da_bdm.png

I will measure this out for you.

Then you need an USBDM interface (fetch a cheap one from ebay) and USBDM software (freeware) and you are ready to go.

[Go4IT]

I was right This is BDM:

kvm_7s7t-19g481-da_bdm.png

MODA and MODB signals are tied to GND on the board, so you can simply attach an USBDM, again without powering the unit itself, and read out the chip. I've attached it for you. It contains a FULL FLAT readout of global memory map 0x00_0000 to 0x7F_FFFF.
The same way i read it out, you should able to erase and write the firmware onto your bricked module and get it back to life again.

For some unknown reason it took several attempd to read before it starts. Got 5-6 times "BKGD ACK timeout" errors. Maybe there is an watchdog active in the chip (COP) or external on the board...

[Go4IT]

Ok, i've got a hunch of what those timeouts come from. I've attached a scope to see what happens when i do a BDM readout. Channel 1 (yellow) shows the /RESET signal and channel 2 (purple) the BKGD signal:

additional_reset_while_reading.png

The first reset is done from USBDM like the specs tell, it lowers the RESET and the BKGD pin, then raises RESET first. This way BKGD acts as MODC signal, which is read from this pin after reset. As USBDM remain the signal low, MODC is "0". This will ensure a normal chip mode with BDM allowed.
After both signals are stable high, USBDM starts communication with MC9S12 via the BKGD line, but after a while we got another reset. See that little spike? This will interrupt communication an raise an errormessage in the USBDM software.

I switched to USBDM Interpreter (commandline tool) and only issue a "reset" command, which usually does the same as the USBDM-MemoryDump tool. Again there is that little extra-reset:

additional_reset_only.png

I took some samples and find out that the reset-time is between 384ms and 423ms:

additional_reset_measure.png

To proof where this signal is comming from, i detached the RESET line from the CPU and only issue a "reset" command in the USBDM Interpreter:

no_extra_reset.png

No extra-reset! This is what i've expected.

So this means that there is some watchdog (WCOP) active in the MCU or there is an external reset-circuit somewhere on the board. I remembered to found such when reading firmware of CMR module (rear view camera). Usually those circuits needs to be retriggered from the CPU through an IO port. If the pulses are missing, the software has crashed an the watchdog device resets everything. It is pretty common for ECUs to have such a device.

Unfortunately the manufacturer decided to put an clear-coat paint on both sides of the PCB, maybe to protect it from corrosion, but this makes it hard to measure and even harder to read the very small markings. I now such devices in SOT-353 packages. But it could also be that it comes from inside the MCU in cause of an active watchdog.

[ZvonimirG]

This is 7S7T-19G481-CA

IMG_20220420_134552.jpg

[Go4IT]

I lifted RESET pin from MC9S12 from pad, soldered /RESET from USBDM directly to it and BANG it works!

readout_reset-pin-lifted.png

So my theory was correct that there must be a reset/watchdog-device somewhere... i haven't found it right now (see https://mk4-wiki.denkdose.de/artikel/ke ... 1-da/start), all other ICs seems to have other functions or are just simple transistors (SOT-323 with markings "W1", "E6", "3F", ...).

But first, i'm doing a full BDM-readout. This is more easy than i thought, just use "flat" mode (not paged) which will use the global addressing mode, and read from 0x00_0000 to 0x7F_FFFF (8 MBytes) which is the maximum addressable range. Then pick the parts we need out of this image.

[Go4IT]

Great pic @ZvonimirG, i'll take that for my wiki. So it seems only a few parts are missing... maybe cheaper to retrofit than to buy new module?
I can't read the marking of the IC, maybe with a different angle it would be better? I heated the surface with hotair-gun carefully, this will make the paint instable an you can scratch it away with a screwdriver. After that wipe it with IPA and a tissue.
Also look for markings of the relais please.

[ZvonimirG]

Ic is NVC1413BD
Relay is ACT512M20 12V