Reading/ Reflashing 29F chips - electrical gurus?

[beyerch]

Chip Repair on board

Not to add a monkey wrench to this discussion; however, I know 100% that there is a 'repair' tool used internally that just clips onto the flash chip; therefore, I do not believe power being distributed on the board is an issue....

FWIW.

Additionally, I've removed/resoldered well over 100 28f400's and put them back in vehicles without any long term issues that I know of. If you'd rather remove the memory chip, get a decent iron, practice, and you'll be fine.

[robertisaar]

but he wasn't sure how the other wired components would interact as power was added to my chip for reprogram.

i believe brad attempted, or at least mentioned this and stopped because of that exact reason...

OBD1.5 anyway.

[chri0029]

I just thought I would close this tread since I opened it. I don't want to leave it too open-ended for anyone looking.

I talked with an electronics professor about how to directly read/ reflash the chip. In a nutshell, he said I could go the long and cheap way which involves making a chain to a PC involving a USB to RS232 (serial port) converter to an 8 or 16 bit addressing interface chip to my PCM chip and a simple C program. I could directly attach a 44 pin test clip (~$40) directly to the chip in the board (since all address pins must be used for reprogramming), but he wasn't sure how the other wired components would interact as power was added to my chip for reprogram. So the safest solution would be to remove my chip from the board and resolder (either a DIP to the board or harness for external chip work). Or I could go the easiest and more expensive way of purchasing the electrical daisy chain above already incorporated into a Willem programmer (incl software) which could be found on Ebay and a PSOP44 Socket adaptor for my 29F chip. All said-and-done, about $150 including the PCM from the junk yard and some really good/careful soldering skills. That includes some inherent risk of damaging the board from a less-than-perfect chip removing or a weak solder job.

The positives: I could reprogram my PCM & BCM chip for a low price, plus any future IC chip I could desolder (Xbox, FTA, etc). The negatives: the tiny particular soldering, risk of board damage, future reliability, and the fact that every vehicle I want to reprogram would probably involve soldering.

Then would come the bin editing (and masking). A whole different story ...

Maybe HPT doesn't look so bad after-all. But I want to first explore the other treads of reflashing through the ALDL. Since I can get the seed/key, I should be able to upload custom bins with a tech2 and software. Let's see where this goes (as read on other treads), then possibly come back to the hardware side of things as Dimented24x7 found it easiest to do years ago.

[pocket-rocket]

I was on the same page as pocket-rocket. I also saw U-tube videos of lots of people soldering/modifying X-box chips. They make it look too easy! But then I began to think of the reliability factor - the x-box doesn't see potholes which could break weak solder welds.

No, but I bet they have thinner, weaker boards to mount to, they use junk lead free solder that sucks (it's not even the right kind to use in this sort of application) and they produce lots of heat in that little box. My Xbox sitting on the entertainment center shelf beside my VCR would actually get warm enough through the Xbox case to get the shelf really warm on the bottom side- through 1/2 particle board. Lead free solder tends to crack with the heat up and cool down cycles an Xbox sees leading to the RRoD which is why people that do long term fixes either a. reflow it, or b. reball the BGA GPU. I'm not trying to be mean, but if you make weak solder connections, you shouldn't be thinking of modifying a PCM. As long as you have good solder connections with the right solder and have things secured well enough not to fatigue, you shouldn't have to worry about pot holes, really.

What about soldering leads to those solder pads and running them to some sort of header or connector that mounted to the case? Then you can close up and seal the PCM again and just plug a cable into the header or connector when you need to reprogram?

[dimented24x7]

Im not a hardware expert, but as for programming, the flash chip's write functions are activated by the WE/OE pin states, and the write protect pin. If the correct voltages are applied, the integrated controller will then accept write commands through the lower 8 bits of teh data bus, if I recall correctly. Bascially, the chip is programmed serially with command bytes and data bytes defining the address and data to be programmed (normally sent by the MCU). The chip also needs a steady bus frequency to operate, so if you want to do something like that, you will need to provide it with just about all the signals it would need to normally operate within the PCM.

Another thing to look into might be backround debugging mode, which is supported by the 683XX MCUs. There used to be info on diy-efi.org for doing this with the earlier vortec PCMs. I dont know if your MCU still supports BDM, but its worth looking into, and easier than what your currently trying to do.

[dimented24x7]

I know in the PCMs I have, just about all the address lines are available as soldered terminiation points for factory testing. My vortec PCM has three long rows of such pins that connect to most of the MPU and flash chip, so you should be able to make connections at those points as well, once you find them.

[chri0029]

Thanks for the site. I was originally thinking of going this way until a few problems came up. First, my chip is surface mounted. Most of these adapters have thru-pins to be soldered through. Secondly, the soldering part scares me the more I think of it due to the solder reliability. Third, there is not a lot of real-estate around the chip for a larger adapter to be mounted.

I made a quick-and-dirty sketch (attached) of my idea above. I hope I didn't over-simplify the device. It might become more complicated as issues arise. The biggest positive attribute is it doesn't require any soldering or modification to the PCM at all. If you happen to interrupt the flash and the chip is junk, just buy a new PCM at a junk yard for around $30 range. Plus they even give you 30 days warranty so you could always swap PCMs if the chip goes null. This concept has a few potential assumptions or flaws: I need to check feasibility with an IC guru if this chip can be JTAG'd which therefore assumes just 100 ohm resistors are needed through a PC parallel port (and applicable software which is just a mod of what's out there already). Also, I assume the chip can actually be programmed in the unpowered PCM board (besides the applied Vss and Vil voltages) without other component resistances interfering. Finally, the AMD specs don't mention JTAG pins, just write/erase pins which make the PC interface potentially more complicated and gives more potential for the chip to HAVE to be removed. This doesn't mean it can't be JTAG'd, but just complicates the process. But again in my chip picture if you follow the wire leads in the board, there is an interesting pattern in the row I highlighted since the leads don't stop at the solder points (they continue on through to the next chip). Unless they go through to the underside of the board (which is difficult to identify), why else would they be there? I have to talk with some electronic or IC experts further.

[bszopi]

http://www.logicalsys.com/

Not sure if anything there would work for you or not..

[chri0029]

Wow, thanks Demented for the link to the awesome write-up. I will have to go through it a few times to have it really sink in (so much info!). I already loaded a bin from this site before and think I found a decent xdf to start with. Then will come the fun of digging-in. But my first problem was actually getting the info from the chip (then starting small - simply adjusting the simple constants).

I was on the same page as pocket-rocket. I also saw U-tube videos of lots of people soldering/modifying X-box chips. They make it look too easy! But then I began to think of the reliability factor - the x-box doesn't see potholes which could break weak solder welds.

I talked with my CE/EE buddies last night, and we might be onto something. Check out the picture of my PCM & chip. We started reading the AMD chip literature & matching the reprogramming pins of my chip. What we realized was an interesting phenomenon - the exact pins needed for a reprogramming the chip are actually already exposed in the board as dabs of solder in 2 rows a few mm from the pins (see arrows of the rows in the pic). Maybe it's a PCM manufacturer debug or manufacturer's reprogram without removing the chip? I'll bet there is a manufacturer's fixture that fits over the chip that directly makes contact with the dabs of solder for this purpose. So, my next thought is to take an empty bread-board and cut or machine out a hole for the chip. Then precisely place contacts on the underside and wires through the top side of the board. When you want to reprogram, just simply place the jig over the chip and bingo - your pre-made jig contacts hit the mating PCM board contacts. No soldering needed! (unless you want to solder wires directly to the PCM board). I'll have to talk with my CE buddies and see if they can program something in C++ to directly JTAG the IC through this jig. The only problem is it may be difficult to find a computer (we all have laptops) with a serial or parallel port for easy JTAG. That's where the USB programmers already pre-assembled make life easy. This is all just a theory, but could be something worthwhile. My EE buddy is going to ask his professor that is well-rehearsed in everything IC for his thoughts.

[pocket-rocket]

It can be done. You will need an SMD rework station with closed loop temperature control (generic chinese units can be found on ebay for not too much) and a good, fine point soldering iron. In the first part of this thread, I have some info on how to get teh chip out: http://www.thirdgen.org/techboard/di...-101-step.html A key thing to do is keep the adjacent components cool when you desolder the chip. Damp paper towels work well for this. GMs PCBs seem to be stable to about 250 deg C, so as long as you dont go crazy with the heat, you wont damage the board or delaminate the traces.

I'm actually looking at this sort of equipment to start fixing Xbox 360's with a more permanent fix. I'm looking at this machine here:

http://store.sra-solder.com/product.php?xProd=6267

Many of the Xbox repair people that post use foil for deflecting the heat to surrounding components. This is a good SMD video to watch:

http://www.youtube.com/watch?v=JB1InDsWCjQ

[dimented24x7]

I only got to take it 1 place so far, and they cautioned against it since the chip is so close to other components. The DIP socket would have to be larger than the IC, so space might be an issue. They said I would have to find a DIP socket first, then take it back to them. Their solder services are $40/hr so that wouldn't be too costly.

They did like my idea of doing a JTAG by directly soldering wires to the adjacent solder points further on the board. Then the chip wouldn't have to be removed from the board. I will have to talk with my EE buddy to see if he has any JTAG experience with similar chips. If it's just a few wires, it shouldn't be a problem soldering into the board.

It can be done. You will need an SMD rework station with closed loop temperature control (generic chinese units can be found on ebay for not too much) and a good, fine point soldering iron. In the first part of this thread, I have some info on how to get teh chip out: http://www.thirdgen.org/techboard/di...-101-step.html A key thing to do is keep the adjacent components cool when you desolder the chip. Damp paper towels work well for this. GMs PCBs seem to be stable to about 250 deg C, so as long as you dont go crazy with the heat, you wont damage the board or delaminate the traces.

[dimented24x7]

If you can get the chip out, i know for a fact that it can be read. It's in the library of my Topmax burner.


i think this is a step in the right direction, we just need someone who will disassemble the binary and write a .xdf for it. tunerpro FTW!

Thats what I did with the vortec PCM (the hack itself is floating around on TGO's DIY-Prom board), but very few people still use the blackbox PCMs. The irony is that the 98/99 computers are very good from a performance persepective. Theyre based off of the older TBI/CPI PCMs with improvements like SFI and mass airflow.

It can be done even with only a dissassembled bin and some basic electronics knowledge and tools. However, its time consuming and it gets exponentially more difficult with each generation of PCM/VCM. I know that the first one I did, which was a TBI ECM, only took a month or so, and thats with no prior experience. The older ECMs are so much more primitive and simplistic compared to the newer stuff. To put it in perspective, for the 98 PCM, the engine alone requires 5 seperate XDFs for tuning. One for spark, fuel, idle, emmisions, and general system parameters, with some 600 total parameters defined between all the XDFs. There is a lot of stuff in these later computers.

[chri0029]

Okay, back to the original tread direction, ...

I took my PCM to some specialty electronic shops today to see if I could pay someone to solder in a DIP (or IC socket). I decided to do this since I began thinking of reliability issues if I did it myself. This is due to the very tiny terminals, plus the chip is soldered to the top of the board rather than through. What if one of the solder joints broke during a large bump in the road or something? Then my vehicle stalls and is dead until I get it towed or change the PCM in the middle of the road.

I only got to take it 1 place so far, and they cautioned against it since the chip is so close to other components. The DIP socket would have to be larger than the IC, so space might be an issue. They said I would have to find a DIP socket first, then take it back to them. Their solder services are $40/hr so that wouldn't be too costly.

They did like my idea of doing a JTAG by directly soldering wires to the adjacent solder points further on the board. Then the chip wouldn't have to be removed from the board. I will have to talk with my EE buddy to see if he has any JTAG experience with similar chips. If it's just a few wires, it shouldn't be a problem soldering into the board.

[SappySE107]

A subscription implies a recurring payment to keep using the setup. You are talking about increasing your abilities and paying to do so. At least I know what you meant.

[chri0029]

Hence my original statement that if $500 were it, I'd be making the purchase now. But basically it's like paying $500 plus a subscription - once I program my computer, I will probably want to reprogram more, then more which becomes a subscription to purchase basically more credits (from the same source of course). Yet the first GM OBDII hack will probably be basically the same pattern as the rest - once you find the right piece of the puzzle it should carry-over from vehicle to vehicle.

From what I read, it seems that the earlier version of the OBDII reprogramming software was VIN unlimited. Then it changes owners and all the sudden it's a price plus a subscription (VIN limited) ...