Posts tagged with "upa usb"

DIY Repair bricked FRM3 by Xprog UPA R270

I get many PM’s regarding bricked FRM3 repair. So thought this thread could be a point of information for people who want to repair their bricked module. By bricked I means EEPROM damage through coding / programming due to voltage fluctuation resulting in IFH-0009 error and no communication via OBD.

In this case the module is still good but requires a good EEPROM dump / p-flash being written to it. Once the good EEPROM is in, communication via obd should be restored and vin / VO will need to changed. You also need to find a correct zusb number and flash it with Winkfp.

 

INFO:
MCU is a 9S12XDT384 (mask 3M25J)

DATASHEET – https://goo.gl/bKDpco
PROGRAMMERS confirmed to support this MCU:
UPA USB Programmer
XPROG-M
R270
Orange 5

EEPROM DUMPS:
My collection of FRM3 dumps – p-flash and EEPROM.
https://goo.gl/6dQuCc
METHOD:
Basically…
1. Erase EEPROM (4096bytes)
2. Write good dump
3. Verify obd working and change vin / VO as if retrofitting used FRM3.
4. Flash with correct zusb number for your vehicle using winkfp.

To connect to the MCU there are 3 methods I’m aware of:
1. In socket – desolder chip
2. In circuit – BDM points – reverse of PCB – see image attached.
3. Direct – test clips onto pins like Pamona Micro Grabbers or cheaper alternative.

Connections to:
BKGD
RESET
VDDR (5v)
VSS

repair-bricked-frm3

Hopefully this is helpful for someone.

http://blog.obdii365.com/2016/09/22/repair-bricked-frm3-by-xprog-upa-r270-orange5/

How to read and write Audi A4 eeprom HC12 in cluster

Purpose:

copy the immo information from a cluster to another
make the mileage follow with the immo information

If clone all eeprom content than the mileage is transferred too.

 

 

Model:

Audi a4 2001

 

Optional devices:

Digiprog3, or ecu programmers like XprogCarprogUPA USB programmer

 

Original cluster:

The Jaeger cluster barely works

audi-a4-2001-cluster

 

audi-a4-2001-cluster-1

audi-a4-2001-cluster-2

Suggestion:

read the pin code from both the Instrument and adapt it to the vehicle

 

What to do on pin 21 and 22 on the chip:

 pin-21-pin-22-on-audi-a4-chip

– With car ECU programmers:

Eprom.set type,mcu,hc12,read,save.
eprom,set type,mcu,hc12,file,load,write.
Buy yourself Xprog-M programmer, Carprog full, UPA USB.
Pin 21 and 22 jumper after programming or wait 10 minutes.

 

– with Digiprog 3:

 digiprog3-read-audi-mileage

Eprom,set type,mcu,hc12,read,save.
eprom,set type,mcu,hc12,file,load,write.

 

Reference:

Eeprom HC12 read and write to the other counter:

 

AUDI MM AB 8/2001 DIAGNOSIS / TACHO DIAGNOSIS

(Write down the exact ALWAYS old / incorrect Mileage)

The diagnostic port is in the driver’s footwell. Turn the ignition

on a vehicle. Connect plug ST16 the diagnostic port and the

DIGIPROG.

 

Select the program: cars / trucks – AUDI – MM 4 / 99- DIAG.

The DIGI PROG II shows you the old / incorrect Mileage.

Enter the new / correct Mileage and confirm this.

Should be then after programming on the speedometer 999999 KM give

The old / wrong KM value again so that the speedometer again the old /

false indicates KM. Now you build the speedometer and break it to the

see board. Solder the green and black wire to the same color marked

Arrows at. Now connect the blue and the green plug with

the speedometer and plug ST41 with the DIGI PROG (picture on the following page.)

Now select the program: cars / trucks – AUDI – MM 4/99 HC12.

The DIGI PROG shows you the old / incorrect Mileage. Enter the

new / correct Mileage and confirm this with the hook.

Now shows you the DigiProg II 5 min wait. Remove the connection

between the DigiProg and the speedometer, wait 5 minutes and build the speedometer

again. Alternatively, for 5 min. Wait, you can also like in the image on the

next page shows the pins 21 and 22 bridges.

audi-a4-hc12-eeprom-1

Here necessarily the board from any power supply (Digiprog3 v4.94,

external power supply, etc.), Pin 21 + 22 bridge, and then you can use the tachometer

Immediately reinstall.

audi-a4-hc12-eeprom-2

OBD365 disclaimer:

TRY AT YOUR OWN RISK

Thanks for all tech support from members’ share at cartechnology forum.

http://digiprog3digiprogiii.blogspot.com/2016/08/digiprog-3-v494-read-audi-a4-eeprom.html

UPA USB device not recognized error solution

Here is the customer solution to UPA USB V1.3 programmer “usb device not recognized” problem.

 

Problem:
Does someone has dump for 24lc128 eeprom v1.3r2? My UUSP upa was working fine, and today it say’s usb device not recognized, I try with dump from v1.2 but working only one time after disconnect and connect again same usb device not recognized

 

Here is dump from upa version 1.3 – for 24c128

https://mega.nz/#!To9VXBYI!l1TpfyO2GWQUUZmP2YqwANvhGEv3HjUQIuQa8Cux8jQ

 

If the eeprom dump works fine the first time, but after usb disconnect and reconnect again it show usb device not recognized again, try one of these two solutions:
1)  fill eeprom with FF and after connect it ask me to update eeprom,  update now it’s working fine.

2) you need to change this N15. N15 is fuse, value about 0R.

upa-usb-programmer

 

http://blog.obdii365.com/2016/04/18/upa-v1-3-usb-device-not-recognized/

Review on China clone KESS,KTAG,UPA,xprog

I am a two-year tuning master. For some time I’ve been interested in the process, since I’ve seen the guys do a bench flash on my ECU. Ruining the FRM on my car made me a bit more determined to really dive into coming to grips with the BDM process.

 

So, I placed a few orders in China and all the boxes came in the last few days. now these are all clone tools, not genuine, but I’m not paying 20 times more for original tools just to scratch an itch. Granted, some of them might not be as good as the real thing and do work perfectly.

China-clone-OBD2-tools-review-1

As you can see, there’s enough to keep me occupied for some time.  There’s a Kess V2K-tag,FgTech Galletto V54 Master, Xprog V5.50R270, J-link and a UPA USB V1.3.0.14 red color device programmer. On the Diag side I’ve got an BWM ICOM diagnostic and programming system without WIFI and a Vas5054 for VAG. There’s also an EDC17 C41 ECU for the E90 320d LCI and I’ve got the FRM that came out of my car. Getting the FRM going is the first job. As with most of the ECUs in the later cars, they all security protected so getting them to submit to flashing is pretty painful so I’m holding thumbs that the tools I have will be able to do what they say it should.
Getting stuck into the complex electronics part is no problem for me, as I’ve got a very well kitted out Lab in which to play. I used to do some serious embedded electronics and programming stuff in a past life and the passion is still there!

China-clone-OBD2-tools-review-2

I was going to tackle the FRM tonight, but we’re now the victim of load shedding so that idea went out the window. I will be updating this thread with more meat as I go, hopefully you guys will get some benefit out of it as well

 

All the tools I have can do checksum calcs. In fact I had a tuner friend over tonight and he showed me some of the ropes using the K-Tag. He even showed me the process in opening these – we had a couple on the grill in the kitchen in order to soften up the glue. My wife only shook her head…

 

We flashed a few Tricore ECUs in boot mode and the KTag Ksuite 6.070 master worked perfectly with the difficult EDC17 C41 I had laying about.

 

What became obvious is that flashing is the really easy part, it’s literally a couple of mouse clicks and it’s done (after butchering the ECU of course). The hard part is understanding how the various aspects of the firmware modules in the ECU interacts with other components in the car, like the CAS. These things are packed full of security to specifically prevent what we’re doing here…

 

Anyway, a few stripped Tricores being massaged into submission

China-clone-OBD2-tools-review-3

Another one of the silly things I wanted to do was to see if I can’t revive the old FRM3 that stopped working in my car. What happened at the time was that I had disconnected the battery and someone went and closed the boot. The only way I could get the boot open was to connect a PSU to the jump points in the engine bay. Problem was that I only had a 5A PSU at the time; this was enough to release the boot but I managed to mess up the FRM in the process. That’s one of the reasons I built a proper 70A PSU as well.

 

Anyway, I suspected that the microprocessor in the FRM went into ‘security mode’ because it detected a brown out condition. This sets the tamper flag inside the FRM and it goes dead. Problem is, you can’t read these microprocessors with normal programmers as the code is encrypted and you need a security key to access them.

 

In comes the XPROG M Box ECU tuning kit that basically allows you to bypass the security measures in these microcontrollers and thus opens it up for you to mess with.

 

I took a flash dump of the working FRM I’ve got in my car:

China-clone-OBD2-tools-review-4

I then grabbed the faulty FRM and loaded a known working software version into it and voila! I’ve managed to fix the faulty FRM and my suspicion was confirmed – the FRM was ok electrically but its firmware got messed.

 

I’m now super chuffed that I can read the security locked microprocessors in these ECU modules. Incidentally, the CAS also uses a microcontroller from the same security protected family

 

In other news, I flashed my whole car with the latest 2014 software. And managed to make the USB and BT inoperable.

 

When looking at the config files of the radio now, I see that there’s no more option to enable USB and BT so I can only assume that BMW ICOM ISTA/P loaded the firmware into the radio that’s used for radios with built in USB and BT. This causes the radio to ignore the MOST loop as it doesn’t need to break out of the radio for these functions anymore. I confirmed that because the MOST loop is now only working under diagnostics, not otherwise. So it’s not bothering to check for a MULF on the MOST bus because it doesn’t need to.

 

I’ll have to update the radio with the correct software in order to rectify this, but this is merely a theory at this point. I’ve a sneaky feeling this will take a while to get sorted out. In hindsight I should’ve just left the software alone, but where’s the fun in that .

http://blog.obdii365.com/2016/02/16/review-on-several-clone-obd2-tools-in-my-lab/

Ford EcoSport 2015 odometer correction with UPA USB V1.3

Used UUSP UPA-USB ecu programmer 1.3 to do odometer correction on Ford EcoSport 2015… Work fined! Just put here for sharing.

 

Tool I used:

UPA-USB Programmer V1.3.0.14

 

Model:

Ford Ecosport 2015

2015 Ford Ecosport

Procedure:

UPA-USB-ecosport 2015 (1)UPA-USB-ecosport 2015 (2)UPA-USB-ecosport 2015 (3)UPA-USB-ecosport 2015 (4)UPA-USB-ecosport 2015 (5)UPA-USB-ecosport 2015 (6)UPA-USB-ecosport 2015 (7)UPA-USB-ecosport 2015 (8)UPA-USB-ecosport 2015 (9)UPA-USB-ecosport 2015 (10)UPA-USB-OLD FORD

DONE!

 

Ps. This is contact of picture this is old model Ford or how new odometer connect

 

Note: source above from a UPA 2014 user- Andres Garcia Zabi

http://blog.obdii365.com/2016/01/19/upa-usb-v13-change-km-for-ford-ecosport-2015/

Xprog-M or UPA to Read Old MB Keys CPU

I have bought a China Xprog-m v5.50 to read out the CPU of the old Mercedes Benz Keys. So i have connected the adapter according to the diagram and installed the programme, but when I´m trying to read out the Cpu there is always “Device is silent. Timeout error“. First the green LED is on for a moment, and then turn red.

 

Then i changed it into com port 1 (com port 29 at the beginning )

 

Soldered the cables to the adapter for the chip…a external 9v cable

On 1 and 28 is + and –

xprog-m-problem (1)

xprog-m-problem (3)

xprog-m-problem (2)

But still the problem: Device is silent. Timeout error.

 

Someone said, “1 foot orange,raise. Oscilator setting automatic setting 2mgh.” (i tried but not worked)

 

Another tip i got from mhhauto and tried:

1- Don’t use any adapter, read the MCU in key.
2- Lift(desolder from key) pin 1
3 – Match the frequenc
y with key crystal (Usualy 2Mhz but sometimes 4Mhz)
4 – select MC68HC05E6(0F82B)
5 – 
pin out MCU with xprog:

VppR—–1(lift)
Gnd——28
B2——–11
B3——–12
B5——–2
B6——–15
VCC——27

 

Ps. USB cable.No need for external power supplies.

 

You can use UPA USB programmer instead xprog, need connect one more wire but it’s more stable.”

 

So I have soldered the MCU on the Key back, and this time luckily, it works fine.

 

However, another problem!! I could read it out and save the .bin, but icannot choose “erase the file to make the key blank to put a other .bin on the key. 

xprog-m-problem (4)
One solution i found in web is to write the new dump in key without erase.

 

Yes, it did!!! It works when i put new dump without erase now.

But first i have tried to put everywhere 00 00 (zeros) and write to MCU, and this works, but when i have tried to write via IR with my ak500 key programmer it doesn’t work.

So i have done via MCU with xprog and it works.

 

But it would be interesting, why ak500 don’t work with this key. I first wanted to read out the blank key, but doesn’t work. Usually when I’m erasing NEC keys and read it out there is “blank key” and i can write it without any problems.

XPROG M V5.55 and UPA USB Table Comparison

XPROG-M ECU programmer any good?Or UPA USB is better?Here is a detail comparison table of X-prog m 5.5 and UUSP Upa v1.3 ecu chip tuning tools.

 

UPA USB chip tuning is good in doing MOTOROLA chip while Xprog-m supports on-board and in-circuit programming of better following chips including Motorola 68HC05, 68HC08, 68HC11, 68HC(S)12 family MCU’s, Texas Instruments TMS370/TMS374 family MCU’s and serial EEPROM’s.

Product XPROG-M Programmer V5.55 2014 UPA USB V1.3.0.14
Image   xprog-m  upa usb 2014
O/S requirement Win XP/Win 7 32Bit/64Bit System Win XP/Win 7 32Bit/64Bit System
Software ver. V5.55 (v5.5.5) V1.3.0.14
Hardware ver. 2015 2014
language English English/Russian
Update By replacing ATMEGA64 Repair Chip No
Quality Ordinary Good
Read secured ECU YES No
Difference in chip tuning Good at doing Motorola 68HC05, 68HC08, 68HC11, 68HC(S)12 family MCU’s, Texas Instruments TMS370/TMS374 family MCU’s and serial EEPROM’s Good at doing MOTOROLA chip
Special Function Decrypt New BMW CAS4;Add New Authorization: AUTH-0025 Authorized support MC9S12HY64/HA32 and NEC function
 Adapters XPROG-M adapters:

 

ADP-0001 TMS370 PLCC28

ADP-0002 TMS370 PLCC44

ADP-0003 TMS370 PLCC68

ADP-0004 Motorola HC05B/X PLCC52

ADP-0005 Motorola HC05B/X QFP64

ADP-0006 ST M35080 in-circuit

ADP-0008 TMS374 family in-circuit

ADP-0009 MC68HC05V12 ADP-0010 TMS374 on-board

ADP-0011 HC11EA9/E9

ADP-0017 HC(S)12 BDM / ARM Micronas in-circuit programming/bypass security adapter

Additional adapter for 5M48H P-Flash

 

UPA adapters:

 

PLCC52 ISP Adapters:
CR16MES & CR16MFS ISP Adapter
MC68HC05B ISP Adapter
MC68HC08AS20 ISP Adapter
MC68HC705B16 ISP Adapter
MC68HC11A8/E9 ISP Adapter
MC68HC05H12 ISP Adapter
MC68HC11EA9 ISP Adapter

PLCC68 ISP Adapters:
MC68HC11F1 ISP Adapter
MC68HC11KA2/4 & MC68HC11KS ISP Adapter
MC68HC11L6 ISP Adapter

PLCC84 ISP Adapters:
MC68HC11P2 & MC68HC11PH8 ISP Adapter
MC68HC11K ISP Adapter
DIL to 10pin Flat-ribbon header (For using IC clips or clamps)
Flat-ribbon cable 10pin

Note If you want to use UPA-USB, you must have knowledge to use with processer. If you want to use Xprog-M, you must be good in soldering.

 

UPA USB Programmer can realize NEC function with NEC adapter (SM03).

Theme: Fresh Print by BlogBaker. Powered by BlogBaker.