E90Post
 


ECS BMW
 
BMW 3-Series (E90 E92) Forum > E90 / E92 / E93 3-series Technical Forums > BMW Coding > FRM3 Resurrection Thread



Reply
 
Thread Tools Search this Thread
      10-27-2015, 04:23 PM   #1
Sensible_
Colonel
469
Rep
2,513
Posts

Drives: 2008 E90
Join Date: Feb 2012
Location: London

iTrader: (1)

***LONG OVER DUE UPDATE***

It's now widely accepted the correct way to repair the FRM3 is by reading dflash.

Once you have a good dump you can extract the good eeprom dump by using this tool:

http://tlvps.tomvanleeuwen.nl/frm/

Offline:

https://github.com/tomvleeuwen/dflas...leases/tag/1.1

All credit to @tomvanleeuwen

https://www.bimmerpost.com/forums/sh...php?p=22126642

***END OF UPDATE***

I get many PM's regarding bricked FRM3 repair. So thought this thread could be a point of information for people who want to repair their bricked module. By bricked I means EEPROM damage through coding / programming due to voltage fluctuation resulting in IFH-0009 error and no communication via OBD.

In this case the module is still good but requires a good EEPROM dump / p-flash being written to it. Once the good EEPROM is in, communication via obd should be restored and vin / VO will need to changed. You also need to find a correct zusb number and flash it with winkfp.

INFO:

MCU is a 9S12XDT384 (mask 3M25J)

DATASHEET - http://cache.freescale.com/files/mic...S12XDFAMPP.pdf

PROGRAMMERS confirmed to support this MCU:

UPA USB Programmer
XPROG-M
R270
ORANGE

EEPROM DUMPS:

My collection of FRM3 dumps - p-flash and EEPROM.

https://drive.google.com/open?id=0B0...nprQzI3R1N2aFE

METHOD:

Basically...

1. Erase EEPROM (4096bytes)
2. Write good dump
3. Verify obd working and change vin / VO as if retrofitting used FRM3.
4. Flash with correct zusb number for your vehicle using winkfp.

To connect to the MCU there are 3 methods I'm aware of:

1. In socket - desolder chip
2. In circuit - BDM points - reverse of PCB - see image attached.
3. Direct - test clips onto pins like Pamona Micro Grabbers or cheaper alternative.

Connections to:

BKGD
RESET
VDDR (5v)
VSS

Hopefully this is helpful for someone.
Attached Images
 
Appreciate 11
      10-28-2015, 06:21 AM   #2
Mik325tds
Major
Mik325tds's Avatar
United_States
694
Rep
1,144
Posts

Drives: 335d M-Sport
Join Date: Jul 2014
Location: Greater Detroit

iTrader: (0)

Thank you, good sir!

Just two points of little confusion:
1. In the picture above you display VCC and GND, while in the text you refer to VDDR (=Vcc?) and VSS (=GND?). Are these assumptions correct?

2. In earlier posts I read that the MCU of the FRM3 can not be reflashed through BDM ports since it has some write protect mechanism. From your post above I gather that this is not true? Or do some of the older FRMs use masked MCUs?
Appreciate 0
      10-30-2015, 05:11 PM   #3
Sensible_
Colonel
469
Rep
2,513
Posts

Drives: 2008 E90
Join Date: Feb 2012
Location: London

iTrader: (1)

Quote:
Originally Posted by Mik325tds
Thank you, good sir!

Just two points of little confusion:
1. In the picture above you display VCC and GND, while in the text you refer to VDDR (=Vcc?) and VSS (=GND?). Are these assumptions correct?

2. In earlier posts I read that the MCU of the FRM3 can not be reflashed through BDM ports since it has some write protect mechanism. From your post above I gather that this is not true? Or do some of the older FRMs use masked MCUs?
Hi,

1. Yes, VCC is power.

2. I never used BDM before for 9S12X MCU. However I am told of the software can decrypt secure state then it's possible. I personally remove chip and program in socket. However I like these micro grabber things so may try that next.
Appreciate 2
Brake_Late1906.00

      11-02-2015, 04:53 PM   #4
Mik325tds
Major
Mik325tds's Avatar
United_States
694
Rep
1,144
Posts

Drives: 335d M-Sport
Join Date: Jul 2014
Location: Greater Detroit

iTrader: (0)

I just ordered an Xprog V5.55. I'll let you know how it works.
Appreciate 1
Brake_Late1906.00

      11-29-2015, 04:47 AM   #5
Mik325tds
Major
Mik325tds's Avatar
United_States
694
Rep
1,144
Posts

Drives: 335d M-Sport
Join Date: Jul 2014
Location: Greater Detroit

iTrader: (0)

Finally got around to trying out the Xprog. It seems to have the ability to get around the security of the HC9S12. I can read Program flash with consistent results, but when I'm reading EEprom I'm just getting garbage. Even the read verify detects problems with the original read and the verification read. When I then compare 2 consecutive reads they have plenty of mismatches.
Am I'm missing something or am I looking at a broken EEprom chip?
Appreciate 1
Brake_Late1906.00

      11-29-2015, 05:17 AM   #6
Sensible_
Colonel
469
Rep
2,513
Posts

Drives: 2008 E90
Join Date: Feb 2012
Location: London

iTrader: (1)

Quote:
Originally Posted by Mik325tds
Finally got around to trying out the Xprog. It seems to have the ability to get around the security of the HC9S12. I can read Program flash with consistent results, but when I'm reading EEprom I'm just getting garbage. Even the read verify detects problems with the original read and the verification read. When I then compare 2 consecutive reads they have plenty of mismatches.
Am I'm missing something or am I looking at a broken EEprom chip?
How are you connecting? In circuit or in socket?
Appreciate 1
Brake_Late1906.00

      11-29-2015, 01:12 PM   #7
Mik325tds
Major
Mik325tds's Avatar
United_States
694
Rep
1,144
Posts

Drives: 335d M-Sport
Join Date: Jul 2014
Location: Greater Detroit

iTrader: (0)

Quote:
Originally Posted by Sensible_ View Post
How are you connecting? In circuit or in socket?
I'm using the method you showed in the picture above. In-circuit. But I'm wondering if I may need the XTAL and XCLKS lines connected as well?
Appreciate 1
Brake_Late1906.00

      11-29-2015, 07:57 PM   #8
Sensible_
Colonel
469
Rep
2,513
Posts

Drives: 2008 E90
Join Date: Feb 2012
Location: London

iTrader: (1)

Quote:
Originally Posted by Mik325tds
Quote:
Originally Posted by Sensible_ View Post
How are you connecting? In circuit or in socket?
I'm using the method you showed in the picture above. In-circuit. But I'm wondering if I may need the XTAL and XCLKS lines connected as well?
Hmm I don't think so. I take it this was a bricked FRM3 you are trying to read? Maybe the EEPROM is just corrupted? Your p-flash reads ok? Have your tried writing new EEPROM?
Appreciate 2
Brake_Late1906.00

      12-01-2015, 03:37 PM   #9
Mik325tds
Major
Mik325tds's Avatar
United_States
694
Rep
1,144
Posts

Drives: 335d M-Sport
Join Date: Jul 2014
Location: Greater Detroit

iTrader: (0)

Resurrected!

Quote:
Originally Posted by Sensible_ View Post
Hmm I don't think so. I take it this was a bricked FRM3 you are trying to read? Maybe the EEPROM is just corrupted? Your p-flash reads ok? Have your tried writing new EEPROM?
Hooray! Success!
Thank you very much for your advice. Much appreciated!
You were correct, the EEPROM was corrupted (as expected). Xprog even gave me a message towards that (duh). Just clearing it and writing a good dump to it worked fine.

You were also correct that XTAL and XCLKS is not needed. In fact, it is counter productive as after doing that and lifting the XTAL pin, somehow the reset of the security doesn't work anymore. Xprog reports "can't connect to BDM" when selecting that. However, it does communicate fine with chip, just on it's own clock rather than the boards crystal.

It also turned out that the Secure mode of Xprog is not needed. I later selected the normal MC9S12XE mode and it wrote to EEprom and Program Flash just fine. However, my Xprog did give me a lot of problems reading either one without mismatches in the verify stage. Don't know why. But restarting Laptop every now and then helped.

By the way, my FRM is using a MC9S12XEQ384 (Mask 3M25J).
I also repaired a friends FRM which used the same chip. You sure the original post is not a typo?

Thanks again, mate. Cheers!
Appreciate 3
      12-01-2015, 05:15 PM   #10
Sensible_
Colonel
469
Rep
2,513
Posts

Drives: 2008 E90
Join Date: Feb 2012
Location: London

iTrader: (1)

Quote:
Originally Posted by Mik325tds
Quote:
Originally Posted by Sensible_ View Post
Hmm I don't think so. I take it this was a bricked FRM3 you are trying to read? Maybe the EEPROM is just corrupted? Your p-flash reads ok? Have your tried writing new EEPROM?
Hooray! Success!
Thank you very much for your advice. Much appreciated!
You were correct, the EEPROM was corrupted (as expected). Xprog even gave me a message towards that (duh). Just clearing it and writing a good dump to it worked fine.

You were also correct that XTAL and XCLKS is not needed. In fact, it is counter productive as after doing that and lifting the XTAL pin, somehow the reset of the security doesn't work anymore. Xprog reports "can't connect to BDM" when selecting that. However, it does communicate fine with chip, just on it's own clock rather than the boards crystal.

It also turned out that the Secure mode of Xprog is not needed. I later selected the normal MC9S12XE mode and it wrote to EEprom and Program Flash just fine. However, my Xprog did give me a lot of problems reading either one without mismatches in the verify stage. Don't know why. But restarting Laptop every now and then helped.

By the way, my FRM is using a MC9S12XEQ384 (Mask 3M25J).
I also repaired a friends FRM which used the same chip. You sure the original post is not a typo?

Thanks again, mate. Cheers!
Good news. Glad it's sorted!

Hopefully more will follow. I always refuse to accept 'bricked module'. All software problems can be solved.

Which EEPROM flash did you use to write? Have you now reflashed with winkfp?
Appreciate 0
      12-01-2015, 06:34 PM   #11
Mik325tds
Major
Mik325tds's Avatar
United_States
694
Rep
1,144
Posts

Drives: 335d M-Sport
Join Date: Jul 2014
Location: Greater Detroit

iTrader: (0)

Quote:
Originally Posted by Sensible_ View Post
Good news. Glad it's sorted!

Hopefully more will follow. I always refuse to accept 'bricked module'. All software problems can be solved.

Which EEPROM flash did you use to write? Have you now reflashed with winkfp?
I used the one closest to my original SW/HW of the module:
FRM3 LED XE 61359241008 hw 06 sw 125000.rar

After just updating the EEprom the module gave me problems again after I took it out again to read the EEprom after updating the VIN and FA. Strangely, now the car warned me that ignition was on??? It also turned on the headlights again and didn't communicate anymore.

I then also flashed the P-flash and updated EEprom again to have a matching set which did the trick.
I have not been able to update to the latest SW with WinKFP yet. It seems I'm missing the daten file of the original SW 9240529. WinKFP will not reflash, even in Expert mode. It says incompatible HW version.
Appreciate 0
      12-02-2015, 01:23 AM   #12
Sensible_
Colonel
469
Rep
2,513
Posts

Drives: 2008 E90
Join Date: Feb 2012
Location: London

iTrader: (1)

Quote:
Originally Posted by Mik325tds
Quote:
Originally Posted by Sensible_ View Post
Good news. Glad it's sorted!

Hopefully more will follow. I always refuse to accept 'bricked module'. All software problems can be solved.

Which EEPROM flash did you use to write? Have you now reflashed with winkfp?
I used the one closest to my original SW/HW of the module:
FRM3 LED XE 61359241008 hw 06 sw 125000.rar

After just updating the EEprom the module gave me problems again after I took it out again to read the EEprom after updating the VIN and FA. Strangely, now the car warned me that ignition was on??? It also turned on the headlights again and didn't communicate anymore.

I then also flashed the P-flash and updated EEprom again to have a matching set which did the trick.
I have not been able to update to the latest SW with WinKFP yet. It seems I'm missing the daten file of the original SW 9240529. WinKFP will not reflash, even in Expert mode. It says incompatible HW version.
Yes, EEPROM won't match your HW version exactly so you must sift through the daten dat files to find a compatible zb number. You will find one I'm sure, then if winkfp won't flash use NFS Emergency Flash, all be ok.
Appreciate 2
      12-03-2015, 12:56 AM   #13
m5james
Lieutenant Colonel
m5james's Avatar
United_States
330
Rep
1,971
Posts

Drives: '10 X5M Alpine White on Sakhir
Join Date: Aug 2015
Location: Marysville, WA

iTrader: (0)

Since I don't know Spanish, can I just mail mine to someone for repair :-) I'm in the Seattle, WA area and it cost upwards of $1200 to have this replaced and coded, thankfully it wasn't paid for by myself.
Appreciate 0
      12-14-2015, 04:20 PM   #14
Mik325tds
Major
Mik325tds's Avatar
United_States
694
Rep
1,144
Posts

Drives: 335d M-Sport
Join Date: Jul 2014
Location: Greater Detroit

iTrader: (0)

Quote:
Originally Posted by Sensible_ View Post
Yes, EEPROM won't match your HW version exactly so you must sift through the daten dat files to find a compatible zb number. You will find one I'm sure, then if winkfp won't flash use NFS Emergency Flash, all be ok.
I used WinKFP in Expert mode to flash the newest SW to the FRM. However, ISTA-P still wants the FRM to be replaced for some reason.
I guess I'm just going to not care what ISTA-P says .
Appreciate 0
      01-04-2016, 02:05 PM   #15
yuyuyuyu
Captain
57
Rep
977
Posts

Drives: 2008 E90 335i
Join Date: Jul 2014
Location: NJ

iTrader: (3)

I have xprog 5.55 up and running, and am using the BDM method to try and revive it, but now I'm encountering an issue where any read/write activity to the EEprom results in an error message:

'Can't get access to BDM'

My device is set to try and read/write under MC9S12XEQ384_EEE.

Tried reading the P-flash and got the same message. Mike suggested a 12V power supply, which I have tried, but still no luck. Could it be the BDM adapter? The BDM points are also just connected with some blue tack and tape...have to go buy a new soldering iron and I'll try again, but just wondering if there's anything else that I should be looking at?
Appreciate 0
      01-04-2016, 02:58 PM   #16
Sensible_
Colonel
469
Rep
2,513
Posts

Drives: 2008 E90
Join Date: Feb 2012
Location: London

iTrader: (1)

Quote:
Originally Posted by yuyuyuyu
I have xprog 5.55 up and running, and am using the BDM method to try and revive it, but now I'm encountering an issue where any read/write activity to the EEprom results in an error message:

'Can't get access to BDM'

My device is set to try and read/write under MC9S12XEQ384_EEE.

Tried reading the P-flash and got the same message. Mike suggested a 12V power supply, which I have tried, but still no luck. Could it be the BDM adapter? The BDM points are also just connected with some blue tack and tape...have to go buy a new soldering iron and I'll try again, but just wondering if there's anything else that I should be looking at?
Hmm, what chip version do you have? Is your XPROG clone or original?
Appreciate 1
Knob19.50

      01-04-2016, 04:35 PM   #17
yuyuyuyu
Captain
57
Rep
977
Posts

Drives: 2008 E90 335i
Join Date: Jul 2014
Location: NJ

iTrader: (3)

Chip on FRM shows MC9S12XEQ384. Most likely a clone, came from china.
Appreciate 0
      01-04-2016, 04:49 PM   #18
Sensible_
Colonel
469
Rep
2,513
Posts

Drives: 2008 E90
Join Date: Feb 2012
Location: London

iTrader: (1)

Hmm, just re read your initial post. Simply remove the BDM adapter...
Appreciate 0
      01-04-2016, 05:40 PM   #19
yuyuyuyu
Captain
57
Rep
977
Posts

Drives: 2008 E90 335i
Join Date: Jul 2014
Location: NJ

iTrader: (3)

Quote:
Originally Posted by Sensible_ View Post
Hmm, just re read your initial post. Simply remove the BDM adapter...
Tried it with and without the BDM adapter
Appreciate 0
      01-05-2016, 10:03 AM   #20
Mik325tds
Major
Mik325tds's Avatar
United_States
694
Rep
1,144
Posts

Drives: 335d M-Sport
Join Date: Jul 2014
Location: Greater Detroit

iTrader: (0)

Quote:
Originally Posted by yuyuyuyu View Post
Tried it with and without the BDM adapter
I used the BDM adapter with the wires. Make sure you have a good contact between wires and PCB of the FRM (definitely solder instead of tape). How many amps did your 12V power supply have?

Can you read the HW info of the Xprog? At least then you know your communication is working.
Appreciate 0
      01-31-2016, 12:20 PM   #21
f00dstamps
Second Lieutenant
United_States
21
Rep
223
Posts

Drives: 2010 BMW 335d
Join Date: Feb 2011
Location: Kansas City, MO

iTrader: (0)

I am believed to have a bricked FRM3. I ordered the XPROG and the BMW INPA / Ediabas K+DCAN cable. The XPROG arrived already and I would like to flash a dump onto it. I'm understanding that I need to code my VIN but I have not received my DCAN cable yet. Will my FRM function at all or better than it does now if I just rewrite the EEPROM on the FRM? My blinkers, courtesy lights, and windows currently do not work but my headlights stay on when my car is in the ignition stage. I need my headights to work at a minimum. I figure that if I save the current EEPROM, I can at least flash that back (at least until I receive my coding cable) if the new dump doesn't work well.
Appreciate 0
      01-31-2016, 03:50 PM   #22
Sensible_
Colonel
469
Rep
2,513
Posts

Drives: 2008 E90
Join Date: Feb 2012
Location: London

iTrader: (1)

Quote:
Originally Posted by f00dstamps
I am believed to have a bricked FRM3. I ordered the XPROG and the BMW INPA / Ediabas K+DCAN cable. The XPROG arrived already and I would like to flash a dump onto it. I'm understanding that I need to code my VIN but I have not received my DCAN cable yet. Will my FRM function at all or better than it does now if I just rewrite the EEPROM on the FRM? My blinkers, courtesy lights, and windows currently do not work but my headlights stay on when my car is in the ignition stage. I need my headights to work at a minimum. I figure that if I save the current EEPROM, I can at least flash that back (at least until I receive my coding cable) if the new dump doesn't work well.
You are correct. Just select a close match dump from my archive and write it to your bricked frm3. Once you have your dcan cable you can find a correct flash file in winkfp and flash the module with your own vin again. Then recode to default with ncsexpert.
Appreciate 0
Reply

Bookmarks

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



All times are GMT -5. The time now is 11:00 AM.




e90post
Powered by vBulletin® Version 3.8.11
Copyright ©2000 - 2020, vBulletin Solutions Inc.
1Addicts.com, BIMMERPOST.com, E90Post.com, F30Post.com, M3Post.com, ZPost.com, 5Post.com, 6Post.com, 7Post.com, XBimmers.com logo and trademark are properties of BIMMERPOST