We have recieved 83% of our goal ..


Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
Bench Setup not working with NBT Evo
#1
Hi all,

i´m currently stuck on a miserable situation. An iLevel update bricked my NBT Evo which is now stuck on flash mode after having successfully flashed BTLD. The full story on how i messed up is written below.
Now if i try to reflash SWFL in car, it will always start with slow UDS protocol. Since flashing that way would take 2-3 days, i want to have a backup option in case i can´t get flashing via enet/http working again.
For bench flashing, i have an ZGW2-8SK with an arduino for wake up (sketch below). With this i was able to flash some ECUs like ICAM, TRSVC and REM without any issues. However, if i connect the EVO to that ZGW, it won´t show up on esys or ista. i´m able to ping it (169.254.199.99 and 169.254.199.119) but can´t do anything else. 
i think one of the reasons for the flash fail is the fact, that the seller didn´t gave me a G30 unit with GPS connector like he said but an F20 one with soldered GPS module and activated via adjust block.
Can someone tell me how to get the Evo to show up in esys on my bench setup or a way to flash HU with OABR to RJ45 connection?
A kind user from another forum tried to fix my issue via VPN but it didn´t work since the VPN connection wasn´t stable enough to safe any changes he tried to make.

i got offers from some coders to fix my HU if i ship it to them but shipping cost and time to outside Germany/EU is very pricey and would take much time so i hope i can somehow fix it myself...


Arduino code:
Code:
#include <SPI.h>
#include <mcp2515.h>

static can_frame message1;
static can_frame message2;
MCP2515 mcp2515(9);


void setup() {
   message1.can_id = 0x130; //formatted in HEX
   message1.can_dlc = 5; //formatted in DEC
   message1.data[0] = 0x45;
   message1.data[1] = 0x40;
   message1.data[2] = 0x22; //formatted in HEX
   message1.data[3] = 0x8F;
   message1.data[4] = 0xFE;

   message2.can_id = 0x12F; //formatted in HEX
   message2.can_dlc = 8; //formatted in DEC
   message2.data[0] = 0x37;
   message2.data[1] = 0x7C;
   message2.data[2] = 0x8A;
   message2.data[3] = 0xDD; //formatted in HEX
   message2.data[4] = 0xD4;
   message2.data[5] = 0x05;
   message2.data[6] = 0x33;
   message2.data[7] = 0x06;
 
  mcp2515.reset();
  mcp2515.setBitrate(CAN_500KBPS);
  mcp2515.setNormalMode();
 
}

void loop() {
  mcp2515.sendMessage(&message1);
  mcp2515.sendMessage(&message2);
  delay(80);
}

Full Story:
Code:
here i´m with a new problem. This time i think i realy f***** up and bricked my HU. I had an retrofited NBT Evo in my F20. An GPS model from an G30.
I received the HU precoded for plug&play. Came with iLevel 18-07 so i think it was prepared with HUTool 2.6.
For a while know i had some issues with the HU:
Sometimes not starting/refreshing Connected drive Services like weather/rtti until i turn off ignition and lock car
Ista permanently showing SDARS Error
HU won´t connect to my Android Smartphone until i reboot Headunit

Some forum members and a BMW dealership told me that this is an softwarebug and i had to reflash/update the HU to get rid of these issues.

Therefore i went ahead and updated my HU to 20-07. Esys took about 1h 20min for the full flash and threw no errors.
After a reboot the screen stayed black. Since car also has a G30 10,25 screen installed, i read cafd, changend fdl to 10,25 touch and id6_light and coded it. Still the screen was black.
i startet ISTA and read DTCs. Found the error "B7F8F7 HU-H: software manipulation". checked measurement plan and it said i should recode HU, so i did the steps above again but still no difference. Could erase DTC but it would pop again after a few seconds. So i thought "maybe just flash again, similar things already happened" (had some other ECUs like REM/ICAM2 that i had to flash two times with current istep to make them work).
Bootloader flashed within seconds without issues. swfl startet flashing and after a few seconds, esys froze, was set to "not responding" by windows and a few minutes later was closed. Rebooted my laptop, connected esys again restartet flashing process. this time without bootloader. the Step "preparing ECU for flash" took much longer this time before starting to flash SWFL. shortly after the start i realized it was much slower than before. A closer look revealed that it was flashing through UDS instead of ethernet/http. I stopped the flashing (it finished the current swfl before) and checked preferences. "deaktive HTTP" was unchecked and "Switchable ECU" was checked. Opened TAL-Editor, changed "preferredProtocol" to HTTP and startet flashing again. Still started flashing with UDS.
Checking psdz.log showd the Error "38000: ECU signaled that any ProgrammingPreCondition not fullfilled, but no further details provided from ECU!"

Since i don´t have a garage and couldn´t leave my car unlocked for hours/days with my laptop in it and a power supply connected, i removed the HU and wanted to flash on bench with my ZGW2-8Sk (it has an build in Arduino to spam wake-up messages on CAN2).
This is the first time i tried to flash an HU on bench (did several other ECUs, Kombis, etc). Placed an CAN-Filter between HU and ZGW. Connected Ethernet
OABR ZGW(Blue Connector)
17 <----> 11
18 <----> 9
19 <----> 12
20 <----> 18
and also connected PIN29 in Quadlock to 12V+ with an 1kOhm resistor.

If i turn the powersupply on, i can connect to the ZGW with esys but reading ECUs will only show the ZGW and nothing else. (a also tried connecting 120Ohm resistors on both ends of CAN2)
The HU will always boot, no matter what´s connected. Even if i unplug everything and only connect 12V+GND, it will power up in flash mode.

that´s the point, where i´m stuck. How can i fix what i might have messed up? is it even fixable?


After some research i found that "B7F8F7 HU-H: software manipulation" might happen because of some kind of sanity check that has to be removed via ssh. I think seller also changed HWEL to 2FC2 since Tool32 shows "NBT EVO id5 (no GPS)" while it has an gps connector. i tried to contact the seller before updating but the only answer i got was "why update the HU?" and no further messages.
[-] The following 1 user says Thank You to Tuerkay for this post:
  • abdelrahmanfarouk7
Reply
#2
(04-06-2021, 10:18 PM)Tuerkay Wrote: Hi all,

i´m currently stuck on a miserable situation. An iLevel update bricked my NBT Evo which is now stuck on flash mode after having successfully flashed BTLD. The full story on how i messed up is written below.
Now if i try to reflash SWFL in car, it will always start with slow UDS protocol. Since flashing that way would take 2-3 days, i want to have a backup option in case i can´t get flashing via enet/http working again.
For bench flashing, i have an ZGW2-8SK with an arduino for wake up (sketch below). With this i was able to flash some ECUs like ICAM, TRSVC and REM without any issues. However, if i connect the EVO to that ZGW, it won´t show up on esys or ista. i´m able to ping it (169.254.199.99 and 169.254.199.119) but can´t do anything else. 
i think one of the reasons for the flash fail is the fact, that the seller didn´t gave me a G30 unit with GPS connector like he said but an F20 one with soldered GPS module and activated via adjust block.
Can someone tell me how to get the Evo to show up in esys on my bench setup or a way to flash HU with OABR to RJ45 connection?
A kind user from another forum tried to fix my issue via VPN but it didn´t work since the VPN connection wasn´t stable enough to safe any changes he tried to make.

i got offers from some coders to fix my HU if i ship it to them but shipping cost and time to outside Germany/EU is very pricey and would take much time so i hope i can somehow fix it myself...


Arduino code:
Code:
#include <SPI.h>
#include <mcp2515.h>

static can_frame message1;
static can_frame message2;
MCP2515 mcp2515(9);


void setup() {
   message1.can_id = 0x130; //formatted in HEX
   message1.can_dlc = 5; //formatted in DEC
   message1.data[0] = 0x45;
   message1.data[1] = 0x40;
   message1.data[2] = 0x22; //formatted in HEX
   message1.data[3] = 0x8F;
   message1.data[4] = 0xFE;

   message2.can_id = 0x12F; //formatted in HEX
   message2.can_dlc = 8; //formatted in DEC
   message2.data[0] = 0x37;
   message2.data[1] = 0x7C;
   message2.data[2] = 0x8A;
   message2.data[3] = 0xDD; //formatted in HEX
   message2.data[4] = 0xD4;
   message2.data[5] = 0x05;
   message2.data[6] = 0x33;
   message2.data[7] = 0x06;
 
  mcp2515.reset();
  mcp2515.setBitrate(CAN_500KBPS);
  mcp2515.setNormalMode();
 
}

void loop() {
  mcp2515.sendMessage(&message1);
  mcp2515.sendMessage(&message2);
  delay(80);
}

Full Story:
Code:
here i´m with a new problem. This time i think i realy f***** up and bricked my HU. I had an retrofited NBT Evo in my F20. An GPS model from an G30.
I received the HU precoded for plug&play. Came with iLevel 18-07 so i think it was prepared with HUTool 2.6.
For a while know i had some issues with the HU:
Sometimes not starting/refreshing Connected drive Services like weather/rtti until i turn off ignition and lock car
Ista permanently showing SDARS Error
HU won´t connect to my Android Smartphone until i reboot Headunit

Some forum members and a BMW dealership told me that this is an softwarebug and i had to reflash/update the HU to get rid of these issues.

Therefore i went ahead and updated my HU to 20-07. Esys took about 1h 20min for the full flash and threw no errors.
After a reboot the screen stayed black. Since car also has a G30 10,25 screen installed, i read cafd, changend fdl to 10,25 touch and id6_light and coded it. Still the screen was black.
i startet ISTA and read DTCs. Found the error "B7F8F7 HU-H: software manipulation". checked measurement plan and it said i should recode HU, so i did the steps above again but still no difference. Could erase DTC but it would pop again after a few seconds. So i thought "maybe just flash again, similar things already happened" (had some other ECUs like REM/ICAM2 that i had to flash two times with current istep to make them work).
Bootloader flashed within seconds without issues. swfl startet flashing and after a few seconds, esys froze, was set to "not responding" by windows and a few minutes later was closed. Rebooted my laptop, connected esys again restartet flashing process. this time without bootloader. the Step "preparing ECU for flash" took much longer this time before starting to flash SWFL. shortly after the start i realized it was much slower than before. A closer look revealed that it was flashing through UDS instead of ethernet/http. I stopped the flashing (it finished the current swfl before) and checked preferences. "deaktive HTTP" was unchecked and "Switchable ECU" was checked. Opened TAL-Editor, changed "preferredProtocol" to HTTP and startet flashing again. Still started flashing with UDS.
Checking psdz.log showd the Error "38000: ECU signaled that any ProgrammingPreCondition not fullfilled, but no further details provided from ECU!"

Since i don´t have a garage and couldn´t leave my car unlocked for hours/days with my laptop in it and a power supply connected, i removed the HU and wanted to flash on bench with my ZGW2-8Sk (it has an build in Arduino to spam wake-up messages on CAN2).
This is the first time i tried to flash an HU on bench (did several other ECUs, Kombis, etc). Placed an CAN-Filter between HU and ZGW. Connected Ethernet
OABR ZGW(Blue Connector)
17 <----> 11
18 <----> 9
19 <----> 12
20 <----> 18
and also connected PIN29 in Quadlock to 12V+ with an 1kOhm resistor.

If i turn the powersupply on, i can connect to the ZGW with esys but reading ECUs will only show the ZGW and nothing else. (a also tried connecting 120Ohm resistors on both ends of CAN2)
The HU will always boot, no matter what´s connected. Even if i unplug everything and only connect 12V+GND, it will power up in flash mode.

that´s the point, where i´m stuck. How can i fix what i might have messed up? is it even fixable?


After some research i found that "B7F8F7 HU-H: software manipulation" might happen because of some kind of sanity check that has to be removed via ssh. I think seller also changed HWEL to 2FC2 since Tool32 shows "NBT EVO id5 (no GPS)" while it has an gps connector. i tried to contact the seller before updating but the only answer i got was "why update the HU?" and no further messages.
Hello how are you?

You said have ping from omap and jucinto, right?If have it can be fixed, just need serial number and hwid
[-] The following 2 users say Thank You to rasool376 for this post:
  • abdelrahmanfarouk7, Tuerkay
Reply
#3
Reconnect it to the car to make sure the bootloader actually flew out or not. The thing about NBT headunits is that when they're in flash mode, they only need power to go back to the blue screen.
If you do not see anymore your nbt2 in esys and bltd was 100% and then fail, it means that your bootloader fell out. I have done flash with gps retrofit many times but it is better to turn off gps in adjust block and then do flash. Now you need usb serial, so If the bootloader loads using usb serial, there is a good chance you will write it again, using right commends.
Reply
#4
(04-07-2021, 07:50 AM)DEJMIEN Wrote: If you do not see anymore your nbt2 in esys and bltd was 100% and then fail, it means that your bootloader fell out. I have done flash with gps retrofit many times but it is better to turn off gps in adjust block and then do flash. Now you need usb serial, so If the bootloader loads using usb serial, there is a good chance you will write it again, using right commends.

bootloader flash never failed. BTLD flashes via UDS without issues. it failed at SWFL and then got stuck in this situation
Reply
#5
So just reconnect it to the car if you can't figure it out on the bench then do it in the car.  A few acrobatics in esys and that's all.
Reply
#6
(04-07-2021, 08:59 AM)DEJMIEN Wrote: So just reconnect it to the car if you can't figure it out on the bench then do it in the car.  A few acrobatics in esys and that's all.

well that´s the main problem. i swapped around 6 times between car and bench.
Couldn´t get the unit out of flash mode or reactivate flashing over http/enet. On bench it won´t show up on esys and in car, it will only flash with UDS protocol (flashtime around 2-3 days).
i don´t have a garage and my car on my parking spot beside the street. Leaving my car unlocked, with a charger hooked up, my laptop inside while it´s raining/snowing here is risky in many ways... that´s why i want to get this fixed on bench
Reply
#7
Then there is few things. Did you make oabr right? There are a few tricks to keep flash in http. I do not know ardunio, let someone else comment on this.
[-] The following 1 user says Thank You to DEJMIEN for this post:
  • D.C.O.D.E
Reply
#8
(04-07-2021, 11:49 AM)DEJMIEN Wrote: Then there is few things. Did you make oabr right?  There are a few tricks to keep flash in http.  I do not know ardunio, let someone else comment on this.

if oabr wasn´t connected right, would i still be able to ping hu?
i tried forcing flash in HTTP by setting preferedProtocol in TAL to HTTP (ofc. unchecked "deactivate HTTP" and checked "switchable ECUs") but in processing, it will stuck on "prepareVehicleForFlash", throw an error and then start flashing in UDS

Code:
<[] prepareVehicleForFlash started [PROGRESS]>
<MCDDiagService<id=20600, job=com.bmw.psdz.jobs.common.MCD3_PrepareVehicleForFlash, service=CC, description=error: negative response : conditionsNotCorrect, link=#RtGen_MultipleEcuJob_LogicalLink> [DIAGSERVICE]>
<MCDDiagService<id=38000, job=com.bmw.psdz.jobs.common.MCD3_PrepareVehicleForFlash, service=RC_CPPC, description=ECU signaled that any ProgrammingPreCondition not fullfilled, but no further details provided from ECU!, link=HU_NBT2_63_ETHERNET> [DIAGSERVICE]>
<[] prepareVehicleForFlash finished [PROGRESS]>
Reply
#9
Since no one could help me and i didn´t want to rob rasool376 his sleep at night, i checked my bench setup again and could fix my issues.
seemed like i made a coding issue on my arduino wake-up signal. could now see the NBT evo on my bench setup.
i bit the bullet and startet flashing via UDS. Since only SWFL was missing, surprisingly everything flashed within 1h 20min.
Evo got out of flashmode and booted. Screen stayed black, so i started ISTA and checked DTCs. Again, the "software manipulation" kicked in and blocked any user input.
with the ECU test in ista, i could make the screen image visible so the headunit itself should work.

i checked FSC status with FemtoEvo and all FSCs are either rejected or unavailable.

will reloading the FSCs with "Feature installer" fix the Software manipulation error or could there be any other reason?
Like written before, it is an F20 HU with a soldered GPS connector and i don´t know if this could be the reason for this error.


Attached Files Thumbnail(s)
       
Reply
#10
Make sure you have the same vin in evo and zgw then detect new cafd.
Reply




Users browsing this thread: 1 Guest(s)