MSS60 Research

[terra]

Of the interfaces they currently sell, the multilink FX, Cyclone LC Universal, and Cyclone FX Universal should support the MPC 5xx/8xx. I have an old cyclone max which also supports the microcontrollers. Cyclone devices are more meant for the production environment / mass programming, but they do function as debuggers too. Cyclone devices include the license for the programming application; for the multilink devices it's a separate purchase.

This is the thread I made there a while ago - http://www.pemicro.com/forums/forum...._topic_id=7230

I do have to say, after messing with all this, I totally get why all the manufacturers have switched to Infineon / tricore. The debugging hardware is built in, and you just need any off the shelf TTL or CAN interface to talk to program the device, and can do debugging with jtag

[pshoey]

Which specific PEMicro device is required? I'll contact sales @ PEMicro and see if they have anything to say about it - i recall you said you posted on their forum? Any chance you can send the link to you post/thread?

Already wasted $250 on the USBWiggler it seems - what's another couple of hundred !!

[terra]

So for what it's worth, I tested the parallel port interface again and it works fine (need a native or PCI/PCIe parallel port - usb won't work). I suspect the debugger for the PEMicro interfaces would also work and certainly would be more convenient than passing a parallel port into a virtual machine and doing things that way. But I don't really want to spend the $200. The programming / flashing application is advertised to be able to clear the censor, but the function is broken. And PEMicro stopped responding to my support requests

[pshoey]

Yeah sorry - master = injection = left.

This makes sense as the left side, i.e. master is the CPU that gets BDM locked!!

I'll try with my parallel port wiggler again also - like you i was assuming USB would be more "reliable" than the parallel port version.

[terra]

Yeah sorry - master = injection = left.

Still not having luck connecting to that CPU. I know it is possible since I did so with the parallel port interface.. You'd think a USB interface that retails for $750 would be more reliable lol. My headers are directly soldered. I doubt any of those joints broke over the last year, especially since this DME has been in storage rather than in an actual car.

[pshoey]

I'm using POGO pins and not having great luck either - I was thinking I'll try and solder some pins to the pads.

Master is the right side and slave the left?

[terra]

So far no luck on my end with the USBDemon. Though I only tried for a little bit today. Dunno if it's a hardware issue or a java issue.

Might try the linux version of OCDCommander, but that looks like a royal pain to setup.

Edit: Actually I can get it to communicate with the slave. Master errors on reset. I wonder if it's a cable issue? Even on the slave, I'm having to use the lowest speed possible. Maybe I need to build a better adapter for the 2.5 -> 1.27mm spacing.

Also I had the wrong command above to reset the watchdog. Try

reset
word 0x2FC004 = 0x0000FF80

[pshoey]

Nice find and at a great price (assuming it works !!)

If you can outline the steps - I'm pretty sure I can put together a program using their interface API to make it easily repeatable.

[terra]

I found a MPC/BDM USB2demon on ebay and ordered that - if I can get it working like the parallel port interface, I'll let you know what steps I took.

[pshoey]

ok - now I understand - so just updating the sw is not what causes the bdm lock, but locking the SK on newer sw versions causes the lock - now that makes perfect sense.

back to trying to get my damn wiggler to give me something meaningful 😕

[terra]

Yes, I read your previous posts but since the lock is triggered when writing/locking the SK which is code in the ECU, I'm really wondering what the code uses to distinguish a DME to lock vs a DME not to lock?

Especially as I have a 9586 unit that seems to be locked and you have one that is unlocked.

The code that triggers the DME lock is embedded within the EWS lock subroutine on newer program variants. Theoretically a DME that was updated to a newer program variant before the EWS was programmed could be in such a state (old stock being used during vehicle manufacturing for example). Or possibly someone used BDM to clear the ISN, and then used Tool32 to program a new one.

[pshoey]

I explained earlier in this thread how the lock is triggered. You can test yourself by flashing an unlocked DME with the newest software - it will remain unlocked. What triggers the lock is locking the EWS SK, which under normal circumstances is done at the factory. Early MSS60 software variants probably didn't trigger the censorship routine when locking the EWS key.

Yes, I read your previous posts but since the lock is triggered when writing/locking the SK which is code in the ECU, I'm really wondering what the code uses to distinguish a DME to lock vs a DME not to lock?

Especially as I have a 9586 unit that seems to be locked and you have one that is unlocked.

[Lambda1]

Well, we should read all before posting . Thanks for explaining there.

[terra]

It would seem to me that the "BDM lock" was introduced by a software update, given that the lock is software activated - I know you (@terra) disagree with that general opinion.

If iam right its bootloader change , like in never versions done by Bosch (ME, MED, MEVD17 and newer onces like MG1, MD1... since ~06.2020. You cant do bench or bootmode there atm).

I explained earlier in this thread how the lock is triggered. You can test yourself by flashing an unlocked DME with the newest software - it will remain unlocked. What triggers the lock is locking the EWS SK, which under normal circumstances is done at the factory. Early MSS60 software variants probably didn't trigger the censorship routine when locking the EWS key.

[Lambda1]

If iam right its bootloader change , like in never versions done by Bosch (ME, MED, MEVD17 and newer onces like MG1, MD1... since ~06.2020. You cant do bench or bootmode there atm).