CAN FLASH programmer for Saab cars

Page last updated 20 May 2010, by Sophie Dexter. 1 reply

First step:

Use the mbed system and it's CAN interface to do some basic things with Saab cars; namely read and re-write the FLASH program in the ECU. (Oh, actually the first step is learn how to write programs using c++). Using the Trionic software suites from this website: http://trionic.mobixs.eu/ and lots of help from the guys at the forum s here: http://www.ecuproject.com anyone can transform the engine in their Saab cars. But, reprogramming the ECU means either taking it out of the car and taking it apart to use the BDM method, or buying a slightly more expensive CAN tool. Having become familiar with the BDM system and working on some of the 68332 assembler scripts I became interested in the whole world of writing computer programs so set myself the task of learning more. Someone on the forums mentioned the mbed system and voila. This project was born.

Progress so far:
Make the mbed processor to something - anything will do:-)
Connect mbed to my spare ECU and get some messages on the CAN bus :-)
Actually read something useful out of the ECU :-)
Upload a new program (a bootloader) to the ECU that can be used to do more - like read the FLASH, erase it and reprogram :-)
Get the bootloader to actually do something (calculate a checksum - it's a start) :-)

Still to do:
Actually read out the ECU FLASH program
Erase the FLASH chips in the ECU
Reprogram the FLASH chips in the ECU

Not as hard as it sounds - the bootloader can already do those things, Erasing is a very simple, just one CAN message, reprogramming is almost identicle to uploading the bootloader in the first place, but the trickiest bit is reading out the original FLASH programming because this is a new bit of the bootloader that I have written and hasn't been tested yet.

Once that is done then I will publish this project so that others can use and modify it as they want :-)

Next, provide a dll that makes mbed look like one of the commercial CAN tools, e.g. CANUSB or CAN232 (I'm using the RS232 over USB way of controlling the mbed program) or OpenCAN. This is important to make it useful to more people - so far I've done things specifically for the original Trionic5 ECU only. With the right type of software DLL it will be possible to use mbed with the T5/7/8suite programs. (so, actually next I need to learn how to write windows DLL programs)

It should also be possible to use mbed as a BDM interface - I tried this first of all and hopelessly failed, but now I have a bit more confidence I will try again once the CAN part is working well enough.Fortunately 'johnc' at www.ecuproject.com has already shared his USB version of the BDM interface so this is not so important, but it would be nice to have a one-stop all-in-one gizmo :-)

After that the sky's the limit, other possibilities are connecting an LCD display to display things, maybe adding an SD memory card to store more ECU programs, who knows what else...

Sophie x

1 comment

Andrew Harpin

# 20 May 2010

I'm surprised it's not protected, most automotive ecu's use custom protocols for the reprogramming elements and are typically password protected.

Then they tend to use offset CRC algorithms to determine if software has been modified.

Many automotive processors also use memory read protection similiar to that in the LPC1768.

 

You need to log in to post a comment