TMS374 ecu decoder, sweeper, clock rom, etc.

[mashupishu]

Hi friends, how things are going?

This week come to us business a client with a citroen saxo 1.6 16v with an immo problem, well not really a problem, the ecu is from a junky-yard so that's the problem. The ecu is a Magneti marelli IAW 1AP.41 with a TMS374 microprocessor and a 28F512 flash memory.

Looking on digital-kaos for information about disabling the immo, and it seems to be different methods on how to do it:


ecu decoder - This method could be done via "software" or using a microcontroller. As far as I understand, on this method a program generates a square wave signal on the serial port that must be connected to the reset pin of the flash memory, then you power up the ecu, execute a program and wait till the job is done. One thread about this method: http://www.digital-kaos.co.uk/forums/f152/tms374-decoder-tool-65582/.

The same for the microcontroller (without a computer), here on the forums are schematics and code for building the "tiny sweeper" from the documentation:


This free Tool is a simple frequency sweeper with 5V square wave output (Duty cycle 50%, effective frequency range from over 10kHz (max 50kHz) to 50Hz) . This tool can be also considered as a MCU version of the software TMS-374 Decoder ECU. The only difference between this two tools is, that the MCU version works without a PC. A small tiny2313 MCU is used to generate the pulses instead of the PC RS232 Tx line. The TMS 374 software is in fact a simple frequency sweeper with an effective range from about 2000Hz to about 100Hz. The Tiny sweeper does exactly the same but much more better (bigger range and is for free).

It could be found in several places around dk and for example in this thread: http://www.digital-kaos.co.uk/forums/f152/tms-374-tiny-sweeper-112968/index2.html#post1128642

Also it could be purchased from multiple sites like: Immobiliser Repair TMS374 ECU Decoder (http://www.tek-tronics.co.uk/product_info.php?cPath=33&products_id=118)

Another method consist in desoldering the 28F512 flash memory, installing a socket, programming a new chip with an special "clock" file, using this chip on the socket, powering up the car for a few minutes, switching it off, removing again the chip and installing the original 28F512 on the socket.

I don't know how this special file known as "clock" can disable the immo in the tms374.

This method and file could be found at: http://www.digital-kaos.co.uk/forums/f178/iaw-1apxx-dump-immo-off-73740/
Other method is done by reading the eeprom of the tms374 using a programmer like xprog-m, look over there: http://www.digital-kaos.co.uk/forums/f155/xprog-m-tms374-manual-3-001-0002-a-86704/, it seems that xprog-m clones don't work well for that chip.
I have also read something about the "tweezers method", but I don't know the exact procedure. (someone knows how is it?


Well lot of options but I have to choose first because I don't have the car, only the ecu. Also I have enough knowledge to build up my own version of the tiny sweeper, so for me seems to be the easiest way.

But I have a problem, I don't understand well two things, first how a square wave applied to a reset pin of an flash memory could disable a immo in any way. Or better, what is the effect of this signal on the flash memory?, it empties it? so is like a virginization???.

And the other question, how the tiny sweeper works?, what kind of signal it generates, it starts at 10Khz and step down to 50Hz, in which rate?, someone knows more about the way that the sweepers works? (software or hardware).

Of course as soon as I finish it I'll publish the schematics and source code of the sweeper.

That's all, thanks in advance for your support.

Best regards, Mashu.

[autodiagnostic]

too long post and less interested to finish reading it!

[mashupishu]

Thank you for your constructive comment, next time I'll write a telegram about something more funny for you.

[zoro1]

i attach osscilograme on the out,please confurm -is right or it is not?Shematic is from link you post.

[mashupishu]

Hi zoro1, how are you?.

Have you used any kind of simulator?, I had tryed two simulators, one for the microchip and other for the avr binaries, but the results as yours I don't know if are good or not, maybe due a lack of enough sampling rate on the simulation, I don't know.

Yesterday I received a hardware one so this afternoon I'm going to try to see the generated signal by it using a logical analyzer that I have here to see the correct pattern, so we can compare the physical one with yours.

After that it'll be simple to design one ;).

See you later. Regards, Mashu.

[zoro1]

Hi mashupishu . (http://www.digital-kaos.co.uk/forums/members/124101-mashupishu/)
No ,i dont try at car yet,but soon peugeot 306 will come ,and i will try,now i make other hardware with max232,controled by COM /232 port on PC.I will compare two output signals.
On delay 10ms works like this :begin from 0 and slow to 100 -PWM modulation,i range of 1 to 5 Volt.
(http://www.digital-kaos.co.uk/forums/members/124101-mashupishu/)

[ecufix]

Please keep us all posted on any successes you might achieve with this project please

[mashupishu]

Actually I'm setting things up to see the sweeping signal, maybe this night I?ll have some results, if not, tomorrow.

See you friends.

[zoro1]

mashupishu (http://www.digital-kaos.co.uk/forums/members/124101-mashupishu/) what is your result?
From PC hardware/one max232 connecter to com/ the signal is close like sweeper.So if one works -then and another mast do the job.
PS. If someone have original tool please post image or comfurn -is the ossciloggrafic picture right or there is differens.But only solution that works,peugeot not come yet,to try.

[xpto]

i have tiny sweeper from tek-tronics and i test it on lots of peugeots and dont work,just on renault .does anyone have the same result?

[mashupishu]

Hi zoro1, how are you?

Well I have just fried my logic analyzer :(, I was measuring the signal generated when after some tries I decided to connect one probe that was oscillating to vcc, don't remembering that it was 12v, and the logic analyzer is ... yes, 5v tolerant ...

Besides that I did two or three measurements and the frequencies that I captured were in the range of 54hz-58hz and I suppose that it was increasing when I did that stupid mistake. Between each frequency change there is a gap of 0.5s of inactivity.

In the weekend I'll back to home (currently I'm out) and I'll have access to my oscilloscope (it's more robust) and I'll report the measurements.

Also I haven't checked if this sweeper works because I always have done the tweezers method, but I'll try it with the next unit.

That's for the moment what I can do :(.

See you, regards, Mashu.


mashupishu (http://www.digital-kaos.co.uk/forums/members/124101-mashupishu/) what is your result?
From PC hardware/one max232 connecter to com/ the signal is close like sweeper.So if one works -then and another mast do the job.
PS. If someone have original tool please post image or comfurn -is the ossciloggrafic picture right or there is differens.But only solution that works,peugeot not come yet,to try.

[Meat-Head]

too long post and less interested to finish reading it!


No that's a good post for people leeching whilst eating lunch



Thank you for your constructive comment, next time I'll write a telegram about something more funny for you.


No it's good - suggest a Telex rather than Telegram - bit more upto date

[zoro1]

Hi
ECU is at home,but accordin one post here in DK,how to chek IMMO -with lamp on MIL pin-if blink Immo is ON,if lamp is lit,IMMO is off,my IMMO is OFF!
Problem is that the car is not here and i need to chek it myself to see what is the problem.
Continue to search.
PS.:For the software with PC -on one of my PC dont work,maybe some application is holding the port,but on other is working.

[autorisp]

Hi mashupishu (http://www.digital-kaos.co.uk/forums/members/124101-mashupishu/),
i read your post and question with more attention.
I will try to answer:
a) Immo disable on ECU with TMS374 micro is based on a unique feature of this microprocessor: When occurs a "Bus Error" the micro erase internal eeprom and reset.
The "Bus error" event can be generated in different ways. One method is applied a Square wave on CE or OE pin.
Other method is apply a ground signal on that pin ( with a 220 ohm resistor ). And so on....
If ECU is on Renault brand ( Safir, Safir2, Marelli )
I prefer a simple resistor but the ecu must be on car because you may need it again several times before the engine work fine.
When the ECU is Marelli apply on PSA and Fiat the simple resistor ( " Bus error " method ) not work.
You need to set internal eeprom at defined value.
This can be achieved only with a "clock file" or reading TMS374 memory, changing eeprom content ( using im*o Kill*r or other im*o program) and reprogramm.
I prefer a "clock file" and for PSA the file "IAW 1APxx Dump immo off " work fine.

b) On 1APxx ecu the diagnostic function is possible only if immo is off. This means you can connect the unit to the bench and try to enter in diagnotic function with your tool.
Or .... connect a lamp on "pump relay command pin". On power on , if immo is in off state, the lamp will light for a few second.
I prefer the first method.

c) In all case you remember to cut immo wire or the sistem not work.

[mashupishu]

Hi zoro1,

From my little experience (two units), it is supposed that if the MIL is blinking the immo is on, and after disabling it the MIL must be off, however, in the two units I've done following the tweezers method the MIL stayed on after applying the tweezers a few times.

This method seems to be a bit strange but it works, but without having the sweeper nor the cars in site for soldering a socket and putting a clock file or reading the tms374, this method seems to be for me the more successful.

I was in the same situation as you, with the doubt that if the immo is off, but I run the risk and it goes fine. Well, immo light on dash stayed blinking but cutting the wire ...

Regards, Mashu.



Hi
ECU is at home,but accordin one post here in DK,how to chek IMMO -with lamp on MIL pin-if blink Immo is ON,if lamp is lit,IMMO is off,my IMMO is OFF!
Problem is that the car is not here and i need to chek it myself to see what is the problem.
Continue to search.
PS.:For the software with PC -on one of my PC dont work,maybe some application is holding the port,but on other is working.

[mashupishu]

Hi autorisp,

Thank you for your fantastic explanation, for me that was one of the missing pieces of the puzzle, why this method works? :D.

I don't know if this can help you, as my experience with this units is nearly null, the first unit I did was a IAW 1AP, following the tweezers method and on bench.

Again thank you for your explanation it's very helpful for me us.

Regards Mashu.

(Today I'll try to put the sweeper on the oscilloscope, but it's a complicated day ;), all have a nice Christmas Eve)

[zoro1]

Hi mashupishu (http://www.digital-kaos.co.uk/forums/members/124101-mashupishu/)
I aply the other wire to positive ,if you are to GND ,mast be reverse signals,if it is OFF mast be dark,if it is ON -blink.

[gzk]

CAN YOU EXPLAIN BETTER THE TWEEZER METHOD IM STUCK WITH 2 ECU CLOCK AND SWEEPER DONT WORK THANKS 1AP80 PSA

[smokey08]

CAN YOU EXPLAIN BETTER THE TWEEZER METHOD IM STUCK WITH 2 ECU CLOCK AND SWEEPER DONT WORK THANKS 1AP80 PSA

Look here (http://www.digital-kaos.co.uk/forums/f178/renault-fenix5-im-o-101129/) at post 2

[mashupishu]

Hi! I followed the method explained on the post that smokey08 indicates to you (pass a tweezer along the side of the chip that has nine pins, short circuiting oposite pins).

Regards Mashu.

[mashupishu]

Well friends, at the very last moment of the year, after breaking my logic analyzer and having passed a fu*k*ing heavy heavy cold, I have some results about the signal generated by my sweeper.

My frequency measurements are: 617hz, 343hz, 261hz, 237hz, 191hz, 161hz, ..., 60hz, 54hz, and finally 50hz.

If you plot this results you have a nice exponential function. The sweeper does it job in one minute and a half more or less, and every pulse train is one second length with half second of inactivity between frequency change.

I was looking for that information because I want to build one by myself, so in the foreseable future I'll try to do it (I'm very busy because I'm moving to another working place and when I get full stablished there I'll start it).

Nothing more for the moment, see you soon and happy new year, oooopsss, three hoursss and counting ...

[zoro1]

So I try sweeper and is working.But there is problem:not working from 1-sttime press start 3-4 and more times.I dont know why ,but this is...
In some case you need to lift pin from PCB.