TCU operation failed

[RAVEN]

Hello, I've been currently working on definitions for the Denso 7058 CAN TCU roms. I've been able to successfully pull the rom from my TCU without an issue, along doing table definition and checksum fixes within Romraider.

Right now the main issue I'm running into is when flashing, it'd beable to read the flashblocks but once it starts actually flashing, it just fails.

20250718_114819.jpg (328.29 KiB) Viewed 73612 times

Any help would be appreciated.

[Gmguy]

What is the calibration number of the TCU you are reading? I al trying to find 30919AB600 so I can unbrick a tcm

[MiikaS]

I found one ROM for 2011 STi from RomRaider forum, not sure if it's the same but maybe worth to test...

A3DE207100

Link to post page, almost the last post
https://www.romraider.com/forum/viewtop ... &start=330

[Gmguy]

I wonder what market that is from, looking at flashwrite 2 files there is a difference between rhd and lhd vehicles. But if i can at least get it talking again i can always get correct file flashed at subaru dealer or see if they will give me the pak file.

This trans is a TG5 also so i might be ok. Now i just meed to find a pinout to connect the ktag to the tcm and power ground etc

When doing the ecu it was the connections marked pbl, the tcm also has the same 13 pins, but i do not know if those pins are the same order as the ecu

[Gmguy]

Hopefully someone may have the pinout required to flash the sh5058s so i can test the connections and confirm if the programming pads are the same as the ones on the ecu

[Gmguy]

Tried to check that file with ktag and it gives a checksum error so wont let me try write it even if I can work out the connections on the board.

I read something about shrecovery module but can not find it in fastecu

[Gmguy]

Here are pictures of both sides of the pcb,
https://imgur.com/a/JjJHEBw

I have found what i think are the correct pins on the data sheet - the pin names are taken from the tactrix/ecu flash shbootmode recovery pdf so I am unsure if they will be the same when using the renasas programming tool.

Planning to make a interface using a usb-ttl tool, just awaiting the bits to arrive.

Pin list i have worked out so far is
PD8 - Pin 1
FWE - Pin 56
MD1 - Pin 55
PB15 - Pin 164
TxD1 - Pin 165
RxD1 - Pin 166

Doing some testing back to the programming pads these are what I have found,

P441 - MD1 - PIN 55 of MCU (100 OHMS)
P431 - FWE - PIN 56 of MCU (100 OHMS)
P431 - PD8 - PIN 1 of MCU (1K OHM)
P435 - PB15 - PIN 164 of MCU (1K OHM)
P437 - RxD1 - PIN 166 of MCU (1K OHM)
P439 - TxD1 - PIN 165 of MCU (1K OHM)

I am going to pull an ECU open tomorrow to try confirm the resistance values as I am unsure what the values should be on the tx,rx and pb15 (watchdog)

[MiikaS]

Tried to check that file with ktag and it gives a checksum error so wont let me try write it even if I can work out the connections on the board.

I read something about shrecovery module but can not find it in fastecu

Well, this is kind of stupid that there is no "general" sh boot mode option to flash chip which lets you flash it without specific checksum, or just bypass it with confirmations...

[Gmguy]

Yes I agree, I dont know why it has an issue with the CS when you have to open an original file to compare anyway. But the pinout of the programming pads that ktag lists for the engine ecu os wrong anyway

[Gmguy]

Found pinouts that remove the 1k ohm resistance from the first testing and now all circuit pinout measurements correspond with tactrix shbootrecover diagram

P441 – MD1 – PIN 55 of MCU (100 OHMS)
P431 – FWE – PIN 56 of MCU (100 OHMS)
P431 – PD8 – PIN 1 of MCU (1K OHM)
P813 – PB15 – PIN 164 of MCU (0 OHM)
P808 – RxD1 – PIN 166 of MCU (0 OHM)
P439 – TxD1 – PIN 165 of MCU (1K OHM)