AKA the 'Universal BD32 scripts for Trionic5.x, 7 and 8 ECUs'
Trionic BDM Suite is a collection of BDM resident drivers (aka scripts) for reading (DUMPECU), updating (FLASHECU), verifying the FB checksum of (CHECKECU) and erasing (ERASEECU) Trionic ECUs found in Saab cars.
WARNING: Use at your own risk, sadly this software comes with no guarantees. This software is provided 'free' and in good faith, but the author does not accept liability for any damage arising from its use.
Saab's Trionic ECU's use Motorola CPU32 based microprocessor chips which can be read and updated using Motorola's Background Debug Mode interface, BDM for short, which connects directly to the CPU on the ECU's circuit board. My BDM Resident Drivers used together with other Freeware software packages and a low cost adapter that connects to a PC's parallel port connector are all that the enthusiast needs to make this possible.
NOTE: BDM is an umbrella term for a number of different interface circuits, Only the CPU16/32 type of BDM adapter is suitable for use with Saab's Trionic ECUs. Other, e.g. CPU-08/12 adapters, with a 6-pin connector, and PowerPC and Coldfire adapters, which have a similar looking 10-pin connector, CANNOT be used.
NOTE: You must connect the BDM adapter to a Parallel Port on your PC's motherboard or a PCI(e) plug-in circuit board. USB to Parallel Port adapters CANNOT be used.
Further information and help with using Trionic BDM Suite can be found on the TrionicTuning and ECU Project forums.
Freeware software for tuning Saab Trionic ECUs is available at http://www.txsuite.org.
Motorola, and more recently Freescale, no longer exist following successive buyouts and NXP now hold the rights to Motorola's legacy CPU chips. Full information about Motorola's CPU chips and links to download Scott Howard's Freeware BD32 and AS32 software packages are available on NXP's website:
- NXP's MC68332: 32-Bit Microcontroller product page includes datasheets and reference manuals for the CPU in T5.x and T7 ECUs.
- NXP's MC68377: Microcontroller product page includes datasheets and reference manuals for the CPU in T8 ECUs.
- Direct download link for BD32, Scott Howard's Freeware Background Debug Monitor for 68300 Parts, needed to use my BDM Resident Drivers.
- Direct download link for AS32, Scott Howard's Freeware DOS Based CPU32 Assembler, needed to assemble or 'compile' my BDM Resident Drivers.
Additions
- Support for ATMEL 29C010 FLASH chips (finally!)
- A new ERASEECU script which erases the FLASH chips. It isn't usually necessary to erase FLASH chips separately from FLASHing them, but this script also uses my 'brute force' algorithm on 28Fxxx FLASH chips which may help to revive 'bad' 28F010 FLASH.
Improvements
- Better filename editing in FLASHECU and DUMPECU scripts
- Consistent error message style for each script
- Better control of the FLASH chip programming voltage.
BUG FIX
- Fixed a serious bug for T5.2/5 ECUS. which prevented the scripts working and displayed the '3: Error: Unrecognised ECU or FLASH chips' message. This was due to a timing issue with the FLASH programming voltage and meant that I couldn't reliably detect 28F010 or 28F512 FLASH chips!
Additions
- A new CHECKECU script which calculates the 'FB' checksum in just a few seconds. This is much faster than DUMPing the BIN file after FLASHing and then comparing files using DOS' 'fc' program to check that FLASHing was indeed successful.
- Enable editing of the filename as it is typed to allow mistakes to be corrected.
Improvements
- Improvements to error reporting messages.
BUG FIX
- Fixed a problem preventing the scripts working with T8 ECUs. Version 1.0 did not work for T8 ECUs because of a memory problem. To be quite honest I am still confused because the MC68377 reference manual is ambiguous when describing its SRAM Module configuration.
- Fixed several others small bugs.
- First release which provides DUMPECU and FLASHECU scripts
- Trionic 5.2 ECUs used in MY93 Saab 9000 Aero cars
- Trionic 5.5 ECUs used in MY94-on Saab 9000 and ng900 cars
- Trionic 7 ECUs used in og9-3 and og9-5 cars
- Trionic 8 ECUs used in ng9-3 cars
All FLASH chips that were originally fitted in SAAB's Trionic ECUs:
- Intel 28F512 chips in T5.2 ECUs
- Intel, AMD and CSI 28F010 chips in T5.5 ECUs
- AMD 29F400T chips in T7 ECUs
- AMD 29BL802C chips in T8 ECUs
Sometimes the FLASH chips in ECU's go 'bad' and it is impossible to reprogram them. Unfortunately the original chip types are difficult or impossible to purchase. Newer generation FLASH chips are available but these use different programming algorithms.
My Resident Drivers also implement algorithms to support the following chips which can be used as replacements in T5.x ECUs:
- Atmel29C512 in T5.2 ECUs
- AMD29F010, SST39SF010A, AMIC29010L, ST M29F010B and Atmel29C010 in T5.5 ECUs
NOTE: Always use Industrial versions of FLASH chips because they work over a wider temperature range.
Pre-requisites
You will need Scott Howard's AS32 Freeware CPU32 cross-assembler. This is a 16-bit DOS application and must be run in a 'real' DOS environment. Make sure that the path to AS32.EXE is in your DOS 'PATH' setting. Please refer to Scott's AS32 documentation for details of how to setup, configure and use AS32.
- Direct download link for AS32 on NXP's webserver.
I use Linux and the DOSEMU application to provide an emulated but 'real enough' DOS environment to be able to use BD32 without rebooting into DOS. The Linux Bash shell has come to Windows 10 and it may be possible to do the same if you use Windows.
You will need the 'touch' utility which I use to set file date and time stamps. Touch is bundled with FreeDOS, the DOS used by DOSEMU. If you are using another DOS environment you can still use FreeDOS' touch:
- Freedos' page about touch
- Direct download link for touch
NOTE: Touch uses your country code setting to specify the date and time format. Since I am British I use the British dd-mm-yyyy hh:mm format for date and time in my batch files.
Assembling Trionic BDM Suite
Run the assemble batch file to assemble Trionic BDM Suite, all 'object' files are put in the release folder, listing and symbol files are placed in the listings folder. Release files are 'touched' with the original release date and the time stamp represents the version number.
Optionally run the clean batch file to clean all output files from the assembler. clean also touches all source files with the current date and time.
Pre-requisites
You will need Scott Howard's BD32 application. This is a 16-bit DOS application and must be run in a 'real' DOS environment. Make sure that the path to BD32.EXE is in your DOS 'PATH' setting. Please refer to Scott's BD32 documentation for details of how to setup, configure and use BD32 and connect a parallel port BDM adapter. The Trionic Suite Manuals, installed along with the Trionic Suites available from http://www.txsuite.org, have further details specific to setting up a BDM environment so that you can reprogram the FLASH chips in your Saab Trionic ECU.
- Direct download link for BD32 on NXP's webserver.
NOTE: You may need to change your BIOS settings and/or edit BD32.CFG to get the BDM adapter to work reliably, refer to BD32.DOC and Trionic Suite documentation for details.
I use Linux and the DOSEMU application to provide an emulated but 'real enough' DOS environment to be able to use BD32 without rebooting into DOS. The Linux Bash shell has come to Windows 10 and it may be possible to do the same if you use Windows.
NOTE: DOSEMU needs an -s switch AND super user privileges to be able to use the parallel port. The parallel port and its address must also be configured in your dosumu.conf file too, please refer to DOSEMU's documentation.
NOTE: BD32 will only work with LPT ports at the 'normal' DOS addresses for parallel ports. PCI and PCIe adapter cards are usually assigned their I/O address ranges by your computer's BIOS and this will almost certainly be different to those needed. My PCI parallel port card came with a DOS program to change the I/O address but this program can only be used in DOS. As a Linux user I use 'setpci' to change my card's addresses like this:
setpci -v -d 14db:2120 0x10.l=0x378 // 0x378 is the LPT1 normal address
setpci -v -d 14db:2120 0x14.l=0x778 // 0x778 is needed too for ECP mode
My PCI card's VID and PID are 14db:2120, use lspci with the -nn and -v switches to find your card's Vendor and Product IDs.
Providing power for your ECU
I strongly suggest you use a regulated power supply to power your ECU. Some laptops use a 16 Volt power supply which would be ideal for T5 ECUs. T7, T8 and T5.x ECUs with replacement FLASH chips only require 12 Volts but it is OK to use a 16 Volt power supply with these too.
Setting up
You can use Trionic BDM Suite in the release folder if you assembled them yourself or you may prefer to copy everything to a new folder. If you downloaded a zipped copy of the pre-assembled Universal BDM scripts for Trionic simply unzip to a folder of your choosing.
- Copy a BIN file that you wish to update your ECU with to your Trionic BDM Suite folder
NOTE: BD32 is a DOS program and only accepts DOS 8.3 style filenames. You will have to rename your BIN file if it has a long filename.
- Connect up your T5, T7 or T8 ECU, BDM adapter and PC's LPT port
- Turn everything on and boot your PC into DOS, or run the DOSEMU application
Using Trionic BDM Suite
There are three different ways to use Trionic BDM Suite:
-
My BDMSUITE batch file may do all that you need, type BDMSUITE at the DOS prompt and give it a try.....
-
Alternatively if you like more control run BD32.EXE then from within the BD32 window:
DO DUMP - Calculates the 'FB' Checksum then DUMPs your FLASH to a BIN file. You can stop the script if the checksum is bad - why DUMP a bad FLASH image?
DO FLASH - FLASH (programs) your BIN file into your ECU then verifies it was successful by calculating and comparing the 'FB' checksum.
DO CHECK - Verifies your FLASH by using the 'FB' checksum.
DO ERASE - Erase the FLASH chips in your ECU.
-
And if you're truly old-school the most basic commands are:
BD32 - runs Scott Howard's BD32.EXE application
DO PREP - Followed by one of:
CHECKECU, DUMPECU, ERASEECU or FLASHECU
NOTES
- Enter the name of your BIN file when prompted:
- Only BIN files are supported, the script adds '.BIN' to the filename.
- The script accepts up to 8 characters for a name (DOS filename limit).
- If your filename is shorter than 8 characters either press the enter key or type a '.' after the filename and the script will use your shorter filename.
- FLASHing or DUMPing a T5.2/5.5/7/8 ECU takes about 2/3/5/10 minutes respectively.
- CHECKing an ECU takes no more than 2 seconds
- ERASing an ECU can take anywhere from a second to a minute.
What to expect to see in the BD32 window:
All scripts apart from the ERASE script should give a visual indication of activity at least once every few seconds. The ERASE script may not show any indication for up to minute when ERASEing 'bad' 28Fxxx chips.
- Progress messages are shown to indicate which operation is in progress.
- Progress indicators show the status of longer operations:
- The start and end addresses of the region of FLASH being read or programmed is displayed during DUMPing and FLASHing of BIN files.
- A rotating 'spinner' is displayed to indicate that your FLASH chips are being erased. NOTE: there may be a pause before you see the spinner when erasing the original 28Fxx FLASH chips fitted in T5.x ECUS.
- At the end of the process a message indicating the outcome is displayed.
NOTE: If you don't see the display change for more than a minute something has gone wrong !!!
Copyright 2012-2013 Sophie Dexter
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and Limitations under the License.
This would not have been possible without Patrik Servin's original work or subsequent contributions from J.K. Nillson, Dilemma, General Failure, johnc, uglybug., krzykoz and many others, please accept my apologies if I haven't mentioned you.
Sophie x