Hi all,
I've been looking into reprogramming the Vectrix MC bootloader by using the jtag connector on the MC.
For reprogramming the flash memory (or flashing) the procedure needs three files and a flashing device:
- one file for erasing the flash to all zeros
- one file for writing the flash with all ones
- one file for programming/writing the bootloader/firmware into the flash
- one XDS510 or compatible jtag flasher
The files need to be in the COFF format for writing them through the jtag adapter.
This three-step-programming is standard procedure for flashing the CPU according to Texas Instruments instructions by using jtag.
When looking into the directory of the scooterdiag programm I did find these three files but they had the .hex extension.
Can someone confirm that these files are in right format, COFF, or do they need to be converted before flashing ?
Another question is: why are these files included with scooterdiag because scooterdiag is programming through the CAN interface where the bootloader is still present in the flash and flashing is not needed at all when the CAN still functions ?
Regards,
Paul
Hello Paul,
The obvious question is why are you trying to re-programme the motor controller through the j-tag?
Not that it matters. The reason that these three files are in the Vectrix diagnostic system is because the diags programme uses them whenever the M.C. hex file is changed /re-programmed.
The process of re-programming the M.C. is carried out in the daftest way possible. First, the whole memory of the M.C. chip is erased including the Can programme. (If the bike is turned off at this time then there is no possible recovery as the Can programme dies due to being held in volatile memory temporarily) The diags then re-programmes the Can along with the new hex file and all is (usually) well.
Those three files are in hex format because that is how they are needed by the diagnostic programme. I doubt that they are suitable for use with a j-tag programmer.
There is a man at dugasengineering who knows the complete answer to your question. You could try asking him.
Best wishes,
The laird
Hi The Laird,
Mainly out of interest i'd like to see if the MC can be revived just in case i wreck something with scooterdiag :-)
I've heard of David Dugas, he was the lead engineer of Vectrix I believe so i guess he also has taken all source codes of the firmware when the company went bust.
Yes i agree the flashing process is pretty stupid designed by TI but thats the way it works so we have to deal with that.
I wonder what the 3rd PRG24_X1.HEX (only 908 bytes) file supplied with scooterdiag is for because when loading new firmware into the MC with scooterdiag you need to point tot the right/latest firmware file.
My first thought about that is that scooterdiag is supplied with a basic get-the-mc-to-work firmware so you can upload newer firmware into it when its 'working' with minimal functions.
Regards,
Paul
===================================
My contribution to EV in The Netherlands
- Novox C20
- Vectrix VX-1 Li+ my2009 #2791
- Vectrix VX-1 Li my2011 #3228
- CityEl Fact4 / Mini El Cabrio
- Th!nk PIV4 A266
- Th!nk City A306
- Tesla Model3 AWD
Hi Paul,
Sorry, but I can't be of much help with these questions. My experience is somewhat limited and there is much complexity in the programming of the whole bike electronics. I do wonder if the complexity is more to do with keeping it all 'proprietary' than it is to do with making things work. Certainly the lack of information on the programming generally is not helping anyone.
Good luck with your endeavours. If you wish to discuss anything further, then send me a P.M. and we will correspond by e-mail.
Best wishes,
Sandy
The complexity is not to make it proprietary. It has more to do with the current state of the art processor circa 1999. The TI processor did not reserve any non-volatile memory for a bootloader. And the flash could only be erased in full so you couldnt put the bootloader in flash and execute it. So, during the boot process, the bootloader has to be loaded into volatile RAM and executed from there. This wouldnt be so bad if it werent for the fact that there is very little RAM. The code literally uses every location of RAM. One of the drawbacks of this is that there is no room for any kind of failure recovery or the opportunity to make the boot process robust. Each of the small hex files is loaded in sequence to the RAM and executed, the final BL hex code is the code that transfers the actual runtime hex code, via CAN, in chunks so the bootloader can flash the processor. Far from daft, and it sure beats tearing down the bike to reach the JTAG port every time you need to reflash the code.
Okay So I figured it works like this:
From the TI literature it seems that the F240 cpu on the mc is flashable either through the jtag or serial/spi interface.
For flashing through the spi interface,which i assume is accesible by some sort of CAN chip, the F240 is out of the factory programmed with a small bootloader.
This bootloader accepts a user program in hex format.
I assume this small bootloader is also included in the Vectrix firmware to provide flashing capabilities anytime.
So what scooterdiag probably does when writing new firmware are the three steps erase,clear and flash the factory bootloader and then transfers the Vectrix firmware into flash.
To revive a bricked mc all it would take is reinstall the factory bootloader through jtag and make the F240 accesible though the spi/CAN again so scooterdiag can access it again and reinstall the Vectrix firmware.
===================================
My contribution to EV in The Netherlands
- Novox C20
- Vectrix VX-1 Li+ my2009 #2791
- Vectrix VX-1 Li my2011 #3228
- CityEl Fact4 / Mini El Cabrio
- Th!nk PIV4 A266
- Th!nk City A306
- Tesla Model3 AWD
Hi prensel
if you get managed to reanimate a dead MC with only wrong data in memory via JTAG, you will be finally our hero here in the forum.
I can remember this old thread which seemed to end without any success.
http://visforvoltage.org/forum/12412-my-vectrix-now-doorstop-failed-firmware-update-attempt
greetings
Klaus
David Dugas is able to reflash an MC board through JTAG. Until someone here find out a DIY way, i'm sure David will help. The board has to be send to the US..
If you're in Europe, vectrixparts can reprogram the board,
They,ve recovered the MC of a friend via jtag, they,re very helpful.