ZAE2 "internal ECU error" repair

[voodoovood]

!! i am not responsible for any damage or injuries !!
!! you are own responsible for everything you do based on this DIY !!!

Hi guys, this is my first DIY.
I am software and microcontroller developer, and i have been ispired by rusty's blog:

https://rustylog.wordpress.com/2013/...ecu-error-fix/

In my friend car, there was a broken airbag ecu, with internal error 195 - which cannot be cleaned by inpa, nor ediabas tool32.

During clear error memory the software says ECU REJECTED COMMAND.

I think this is possible by two ways - the first is, that the module has been in already crashed car, or somebody with ncs expert, or some other software would like to disable the airbag.
there are two copies of configuration in eeprom, and both of them must be same - if not, the unit will throw the internal ECU error, and this is not clearable by any software. ( rusty have how to with some versions, but not ZAE2)

What you will need:

• one ECU with error 195 - internal ECU error
• 5V DC power supply
• screwdrivers and other tools to remove the unit from car - it is in the middle tunnel under rear a/c exhaust.
• torx screwdriver to open the unit
• one PC sata cable( i have used the wires from this cable) or really thin isolated wires.
• soldering station
• magnifying glass - it is all really small
• needle - for pull up the legs of CPU
• one resistor - something between 5k and 50k
• one RS232 to TTL level shifter - based on MAX232
• and one PC with REAL serial port - no USB serial converter - it will dont work( the break signal is need for startup)
• internet connection
• software
  
  • hexeditor - i used HxD - you can find it free
  • Jbug11 - you can find in free
  
  
• stable hands and a lot of beer

Photos, tools, and PDF how to is there:
https://drive.google.com/open?id=1y6...SDrdkxoMPbMfCC
if anybody can, please, make some mirror. thank you.


So, on the table i have one airbag ECU - mine one was temic 8362072 - but the eeprom map is almost the same as newer versions.



1) when the unit is still in the car, lauch up some diag, and read out the error codes, the mine was :

• 21 - something with driver auirbag (hex 0x15)
• 195 - internal ECU error ( hex 0xC3)
• 65 - something with passenger seat belt ( hex 0x41)

1A!) reset to default configuration - (NCS Expert, SG_CODIEREN with the blank MAN file) - it will finish with error, but just because at the and the ncs expert want to clear errors.

2) remove the unit from car - i am a software devoloper and i can find on internet - where it is, and how to take it out ( 20 mins)

3) ensure, that you have pc with real serial port - cannon d9 on mainboard. rs232 ttl converter

4) remove 5 screws, and take out the board

5) you need to carefully heat up and lift 2 pins - MODB and RESET - you can find in PDF which two. i have used soldering iron and long needle.
it is because - the MODB pin - you must connect it to GND(0v) but it is hardwired to VDD(5v) and the RESET pin is managed by watchdog, and sending resets every couple milliseconds. So you must take it under your control

6) then prepare and connect 6 wires -

• RxD - you will connect it to TxD pin of converter
• TxD - you will connect it ro RxD pin of converter
• MODB - you will connect it ro ground - good idea is to connect it over 47k resistor - to protect agains short with VDD
• RESET - you will connect it over resistor to VDD(5v)
• VDD - connect to 5v power source (5v)
• GND(VSS) - connect to converter GND and power source GND

7) after everythig is wired up - start the JBug11 software(working also on win10 64bit - tested) and configure the cpu type, com port and frequency(16Mhz),
8) power up the power supply to unit,
9) click OPEN button in Jbug11
10) manually take the RESET pin to GND(0v) for a short time - you must see : " Break received, now booting the talker"
11) the JBug will send the bootloader to CPU, and the "talker" must echo bytes. - can see on screenshot
12) press the save button and save to file a location from D80 to FFF - now - you have and image of your ECU eeprom - save it
13) start your favorite hex editor - i have used HxD and erase the error log - as you can see in PDF document.
14) then in Jbug11 - before the writing he eeprom back, you must disable write protection - on the bottom there is a single line command edit box send:

• r bprot=0

15) erase the whole eeprom by command

• ebulk

16) click on the write to chip icon, and upload your modified file.

17) wait 30second to finish the write - you can find in menu Verify tool and verify that write was correct.
18) turn off power supply,
19) desolder wires
20) push down, and solder back this two pins MODB and RESET
21) complete the unit
22) mount in car
23) happy now?

I have spent the whore weekend - more then 20 hours - to complete this task - because of reseach, internet, motorola 68hc11 microcontrollers( it is really old), and reverse the circuits.
I think it is good idea to share my work - so please - if it was useful for you, post some comments, photos, and some more info. thank you much.

and now, take a beer.


Photos, tools, and PDF how to is there:
https://drive.google.com/open?id=1y6...SDrdkxoMPbMfCC
if anybody can, please, make some mirror. thank you.


if anybody can prepare better HOW TO, just post it there, i will be happy - a have no much time for this.

have a nice time

[EWBR]

Hi,

Let me say excellent work, I will check it out on one of the next weekends.
Thank You!

EWBR