VVDI Prog read D70F3624 from PSA Airbag

Xhorse VVDI Prog

Written by:

Here is my experience of VVDI Prog reading D70F3624 from PSA Airbag. Big thanks to Samic’s technical support.

First, read D70F3624 from PSA Airbag, but not working.


[2016-10-21 16:30:08] : Select <D-FLASH>

[2016-10-21 16:30:13] : Check Device…

[2016-10-21 16:30:15] : 12V Power Adaptor connected

[2016-10-21 16:30:15] : Initialization device…

[2016-10-21 16:30:17] : Initialization success!

[2016-10-21 16:30:18] : Initialization chip…

[2016-10-21 16:30:19] : Try Frequency 04000000

[2016-10-21 16:30:19] : Try Frequency 08000000

[2016-10-21 16:30:19] : Try Frequency 10000000

[2016-10-21 16:30:20] : Try Frequency 12000000

[2016-10-21 16:30:20] : Try Frequency 16000000

[2016-10-21 16:30:21] : Try Frequency 20000000

[2016-10-21 16:30:21] : Try Frequency 04190000

[2016-10-21 16:30:21] : Try Frequency 01000000

[2016-10-21 16:30:22] : Try Frequency 02000000

[2016-10-21 16:30:22] : Try Frequency 05000000

[2016-10-21 16:30:23] : Try Frequency 06000000

[2016-10-21 16:30:23] : Try Frequency 09000000

[2016-10-21 16:30:23] : Try Frequency failed

Tried with and without external +12V supply.

Also tried manual frequency 8MHz and 4MHz. (I saw it was tested automatically but tried anyway.)

Tried with and without FLMD1 connected. (Not used by other programmers)

Also lifted 2 pins that you can see on pictures that were connected to RXD and TXD lines.

Using MCU Reflash Cable V2 (verified connections inside, yellow wire on correct location, also did continuity test on the other wires)

I tested myself the test points where I’m soldering against the MCU pins.

Some technical stuff from Samic:

VCC is set to 4.5V as default and measured 4.55V on pcb.

FLMD1 always at 0V.

FLMD0 pulled up to 3.5V.

RESET when goes up reaches 4.5V.

TXD when goes up reaches 3.9V, RXD 3.3V, bit timing of both RXD and TXD at any frequency set is always 104us (9600 baudrate).

Oscillator on board is 8MHz.

There are messages on both RXD and TXD.





Tried with another programmer that reads it fine.

Device id:

10 7F 04 61 7F 7F 7F 8F 80 80 80 80 02 7F 7F 01 02 C4 37 B0 46 B3 B3 37 31 20 20 7F FF 00 00 00

VVDI prog doesn’t even reach that part, it stops after the first reply of the mcu.

I recorded my other programmer reading it with Saleae Logic (v1.25)

Also Technical stuff from Samic:

checked dump, this programer use the default low baudrate 9600bps to read data.

VVDI PROG changed baudrate to 153600bps to decrease read time

baudrate change step:

1.Use low baudrate 9600 wakeup the chip, if get the correct response,go to step2

2.Start change baudrate, due to the d70f3624 doesn’t know own osc frequency,programer need send it the accurate value

(VVDI PROG put some common-used osc value,so you can see try frequency xxxxhz info)

3.Programer send the new baudrate value to d70f3624, vvdiprog use 153600bps

the d70f3624 can calculate the new baudrate with the osc value, but if the osc value is incorrect,you will get a wrong baudrate

(eg: the actual osc is 4Mhz, if you set a 8Mhz osc value and change the baudrate to 153600bps the chip will set a 76800bps)

4.Use the new baudrate to communicate

Maybe the osc frequency is not in VVDI PROG osc value list

Please grab a new dump with vvdiprog, need to further analyze of the problem.

Good luck!

Copy Protected by Chetan's WP-Copyprotect.