8051 Non-invasive unbricking

[steveo]

a small project log

for bricked lt1 ecms where the flash chip is still ok, to avoid socketing them as a repair measure, re-flashing without removing the chip seems to be a good way to go. not everyone wants a socket.

kur4o tipped me off a while ago that there's an unused header on the board that's mostly connected to the flash chip.. and doing a bit of ohm-metering this certainly seems to be the case.

my plan is to fabricate a solderless connector for this header and a small harness to go to my programmer, so i can just hook it to an 8051 board and fix a borked flash.

the other possibility i thought of, is modifying a plcc socket to work upside-down and building a small harness to go to my programmer, but i want to use this header just for the fact that it's a bit more of a challenge.

the header seems really ideal, though.

i'm not sure if it's completely pinned out or not, im going to sit down, scrape off all the silicone, and get a proper mapping. will report back with pinouts soon.

one question, does anyone know if ALL of the pins are necessary for programming, or if some can be omitted? (data sheet pic attached)

the only other thing i haven't figured out is the best way to build a connector for it. copper springs seem ideal, kind of like in a standard pc card socket.

[Montecarlodrag]

I have used PLCC sockets for On-Board programming. Custom software has to be written to accomplish that since universal programmers will not work with a soldered chip. All of them had a custom circuit board. It works pretty good, the devices I used in the past saved me a lot of work and I made a lot of money with them
Something like this

[steveo]

Custom software has to be written to accomplish that since universal programmers will not work with a soldered chip.

can you elaborate on that, why wouldn't it work on a soldered chip, and how could that be worked around in software??

[steveo]

pinout of the header (numbered as pictured) to the flash chip:

FLASH PIN, HEADER PIN
1,22?? (VPP)
2,NONE
3,7
4,18
5,13
6,14
7,35
8,20
9,11
10,10
11,9
12,36
13,28
14,27
15,26
16,22(GND?)
17,25
18,29
19,30
20,31
21,32
22,NONE
23,12
24,NONE
25,19
26,33
27,34
28,37
29,8
30,NONE
31,6
32,1

seems like VPP is grounded when not in use? so i need to find the pin that goes to whatever applies vpp voltage?

[Montecarlodrag]

Universal programmers give all kind of errors when you try to program a chip soldered to a board. They are not designed to do that, they need the chip to be placed directly on it to work.
The tools I have used to flash directly on-board chips were custom interfaces with special software.

The header in your picture appear to be some kind of BDM, it may be a better approach.

[kur4o]

VPP comes from small 8 pin chip on black/red side. It is shorted on both sides.
That`s the label on the chip. It is at middle of board.
014
m36av
65422

My first impresion was that these pins were left for connecting the two boards. Later found by accident that most pins goes to flash chip.
I guess the point of this header is for devepment purpose. Looks like as a memcal header, external chip board header, or some special gm private tool to access direct memory addresses for debuging.
I notice that all later style boards, up to 2005 have similar style headers.
I also want to get a hold of one of this memcals with the proprietary software it comes with. It will be real fun.

[Montecarlodrag]

Those pin headers normally are a Jtag or BDM interface, only used for production/development repairs since they give direct access to the CPU and allow flash even without a running OS.

[Six_Shooter]

I'd be looking to see if some of those pads are connected to the necessary pins for JTAG or ICSP debugging/programming.

Also you can get spring loaded pins for making such interfaces. Generally referred to as "Pogo-pins".

[steveo]

Also you can get spring loaded pins for making such interfaces. Generally referred to as "Pogo-pins".

hah those are awesome! that's just what i was looking for, thanks

I'd be looking to see if some of those pads are connected to the necessary pins for JTAG or ICSP debugging/programming.

there are a few visible traces to the processor. it's a 40 pin header, and 28 are certainly connected directly to the flash chip. that leaves a lot of pins... i'll get a datasheet for the chip poke around and see what else i can find.

[lionelhutz]

I'm also thinking the most likely use of that header was connecting an emulator GM would use.

I'm doubting you'll have much luck just programming with it but it could happen. Remember, you'll have to power the board to power the flash chip and once you do that the processor will be trying to control it. So, unless the processor/ board releases all the pins connected to the flash chip into a high impedance state you'll be fighting the other circuits when trying to do the programming. The board might be built so you could just power the flash chip and program it though that header, but I'm thinking the chances of that are rather low.

The pogo pins are cool, but you pretty much need a circuit board to hold them all solidly in the exact right positions.

[steveo]

The board might be built so you could just power the flash chip and program it though that header, but I'm thinking the chances of that are rather low.

i do know it's possible to reprogram in-place, just due to the fact that you can send your ECM out to be repaired without de-soldering the chip.

[Montecarlodrag]

Remember, you'll have to power the board to power the flash chip and once you do that the processor will be trying to control it. So, unless the processor/ board releases all the pins connected to the flash chip into a high impedance state you'll be fighting the other circuits when trying to do the programming. .

When you are in programming mode the flash process is made thru the CPU not directly to the flash. There are software and hardware ways to make the CPU enter programming mode so all other tasks get stopped until the CPU is released to run the OS, normally after the flash is done. This way the flash process isn't interrupted.
If you try to program the flash chip directly while soldered to the board you will get many problems using conventional methods.

That's how bricked PCMs are repaired, using a BDM interface which allows direct programming/reading of the flash. It doesn't matter if the flash is corrupted/blank, the CPU allows full access to it. The only problem is: you need to have a raw binary image of the chip to flash it, other formats like .cal, .hpt, .jcl etc are useless. The only way to get access to those files is reading a working one and saving it.

[lionelhutz]

When you are in programming mode the flash process is made thru the CPU not directly to the flash.

You meaning during ALDL programming or if you attempt to program a blank or corrupt flash chip? Of course you use the processor normally to re-flash it, but you can't if the flash is corrupt and the processor won't run reflash code.

There are software and hardware ways to make the CPU enter programming mode so all other tasks get stopped until the CPU is released to run the OS, normally after the flash is done. This way the flash process isn't interrupted.

It's quite possible the extra pins on that header are used to achieve this. The sequence would be to "halt" the processor and turn on Vcc. Then program the chip. But, as you posted before this will require a custom built interface.

[lionelhutz]

i do know it's possible to reprogram in-place, just due to the fact that you can send your ECM out to be repaired without de-soldering the chip.

Sorry, I meant it would be a rare board that would allow only a chip programmer to be able to program the flash on-board. You could come up with a design that isolates the flash to allow that, but it'd require more parts that GM wouldn't spend the money on. Which means I think your initial though of just connecting a programmer will not work.

[Montecarlodrag]

You meaning during ALDL programming or if you attempt to program a blank or corrupt flash chip? Of course you use the processor normally to re-flash it, but you can't if the flash is corrupt and the processor won't run reflash code.

It's quite possible the extra pins on that header are used to achieve this. The sequence would be to "halt" the processor and turn on Vcc. Then program the chip. But, as you posted before this will require a custom built interface.

No ALDL
BDM and Jtag interfaces can talk directly to the CPU, it's a built-in feature of some processors. If you have the correct hardware and software you can talk directly to the CPU even if the flash is corrupted or blank. Most other tasks are halted until you exit debug mode.
Some CPUs are halted using a software command, others need a jumper to force debug mode.
Once you take control of the CPU you have full read/write access to the Flash and EEPROM chips. Virtually everything the CPU is able to do you can have access to it. It's a low level programming/debug mode.

I have used Jtag and BDM, it allows you to do thing no other tool can, like writing a specific area of the flash chip, write to protected areas etc.