Infineon Tricore BSL (Module 53)

Infineon Tricore BSL (Module 53)
The module supports TC1724/1728/1738/1762/1766/1767/1782/1793/1796/1797, as well as 1796+external

FLASH 2/4Mb.
The supported ECUs:
TC1762/TC1766 MICRO (1504KB)

TC1762/TC1766 EEPROM (32KB)
TC1796 MICRO (2048KB)
TC1796 MICRO+EXT (4096KB/6144KB)
TC1796 EXT (2048KB/4096KB)
TC1796 EEPROM (128KB)
TC1738/TC1767 MICRO (2048KB)
TC1797 MICRO (4096KB)
TC1797 EEPROM (64KB)
TC1724/TC1728 MICRO (1536KB)
TC1782/TC1784 MICRO (2560KB)
TC1793/TC1798 MICRO (4096KB)
Possible password reading for SIM2K-24x, Ford EMS22XX, Ford SID20X, Bosch, Bosch GPT, etc.
The list of successfully tested ECUs:
Bosch
VAG MED17.1 TC1796
VAG MED17.1.1 TC1796
Ford MED17.2 TC1767 TPROT7
Ford MED17.2 TC1767 GPT
BMW MEVD17.2.4 TC1797 GPT
BMW MEVD17.2.9 TC1797 GPT
PSA MED17.4.2 TC1767
VAG MED17.5 TC1766
VAG MED17.5.5 TC1766 GPT (The password is to be read via Ford/Opel/Volvo)
VAG MED17.5.5 TC1767 GPT
VAG MED17.5.21 TC1782 GPT
VAG ME17.5.24 TC1724 GPT
VAG ME17.5.26 TC1724 GPT
MB MED17.7.1 TC1797 TPROT7
MB MED17.7.2 TC1797 GPT
China ME17.8.8 TC1728
K/H MEDG17.9.8 TC1767
VAZ ME17.9.7 TC1762
K/H ME17.9.11 TC1762
K/H ME17.9.12 TC1762
K/H ME17.9.13 TC1762
UAZ ME17.9.71 TC1724
BMW EDC17CP02 TC1766 TPROT3

K/H EDC17C08 TC1766 TPROT3
PSA EDC17C10 TC1797 TPROT7
MB EDC17CP10 TC1796+EXT (a 120Ω resistor is required)
JLR EDC17CP11 TC1796+EXT TPROT6
K/H EDC17CP14 TC1796 TPROT3
K/H EDC17CP14 TC1796 TPROT11 (password reading in the vehicle or using the automotive battery power)
VAG EDC17CP14 TC1796
VAG EDC17CP14 TC1796+EXT
VAG EDC17CP14 TC1796+EXT GPT
VAG EDC17CP20 TC1796
BMW EDC17C41 TC1797 GPT (GPT pins T96.9 T96.92)
VAG EDC17CP44 TC1797 TPROT8+
VAG EDC17C46 TC1767 TPROT8+
VAG EDC17C46 TC1767 GPT
MB EDC17CP46 TC1797 GPT (a 120Ω resistor is required for CAN bus)
Volvo EDC17CP48 TC1797 GPT
Iveco EDC17C49 TC1797
Iveco EDC17CP52 TC1797
K/H EDC17C53 TC1767 TPROT8+ (microgrippers were used)
VAG EDC17C54 TC1797 TPROT8+
BAW EDC17CV54 TC1767
BMW EDC17C56 TC1797 GPT (GPT pins T96.9, T96.92)
K/H EDC17C57 TC1793F TPROT8+
MB EDC17CP57 TC1793 GPT
GM EDC17C59 TC1767 GPT (GPT pins T60.29, T60.58)
Siemens/Continental
K/H SIM2K-241 TC1767
Ford SID208/SID209 TC1797
Ford EMS2204/EMS2211 TC1738
Delphi
GM MT-60 TC1766
China MT-80 TC1762
GM MT-80 TC1762
K/H MT-86 TC1766
MB CRD 3.10 TC1797 (a 120Ω resistor is required for CAN bus)
Operation speed will be a welcome surprise. The file format is usual (BIN).
Any J2534 adapter can be used. There is a possibility to automatically control the power via L-line (ground
with the power on), like in Multiflasher and ChipLoader. Besides, in the BSL mode there is +5V voltage in the
12th adapter contact which can be used for boot pins switching.
Terminology (the developer doesn’t claim to be absolutely precise, but adapts the terms for better understanding).
1) BSL - bootstrap loader – a special CPU mode when it loads its software not from the internal or external
memory, but through some external interface, e.g. CAN bus or a serial port.
2) TPROT - tuning protection – a general term for Bosch technology for protecting the ECU software from
outside modification including both ECU software protection ("RSA signature"), and hardware one (CPU
internal memory access password).
3) GPT – a special Bosch ECU mode used for reading passwords of some ECUs.
General Operating Procedure
1) Remove the ECU;
2) Define the ECU pinout using the appropriate schematics, and if there is no schematic, it is possible for
Bosch ECUs to define the connection points using the programming board (ECU opening is required);
3) Using a multimeter check if there is a terminator (a 120Ω resistor) on the CAN bus; if necessary ‘connect’
the resistor from outside. If you have a special adapter for working in the BSL mode, this resistor is likely to be
inside it already and there is no need to connect it. Please note that the resistor can be connected always,
from the developer’s experience, it will be helpful as CAN bus normal resistance in the vehicle is 60Ω (two
terminating resistors in the ECU on the CAN bus ‘edges’, i.e. connected in parallel).
4) Read the password from the ECU, do as follows:

а) if there is a special module for password reading, use it;
б) if it is a Bosch ECU, there are a few variants:
- the ECU TPROT version is earlier than 8, there is no need to read the password as the loading program will
automatically identify it while reading in the BSL mode;
- the ECU has unknown TPROT, but there is a special variant of password reading, e.g. VAG or Kia/Huyndai,
in this case try to read the password with this special module. If reading has been successful, but you have got
the massage ‘Blank password is read’ it means that the ECU TPROT version is earlier than 8 and the
password is not needed;
- the ECU has GPT1, GPT2 pins in the connection diagram, in this case use one of the GPT modules for
password reading (do not forget to connect the right pins). If reading has been successful, but you have got
the massage ‘Blank password is read’ it means that the ECU TPROT version is earlier than 8 and the
password is not needed. If password reading does not start for a long time and the loading program says
about ‘Preparation’, then check the connection and make sure that the power for the GPT board is provided
at the same time with the ECU switching on. Besides, note that it can happen that password reading in the
GPT mode requires using dedicated CAN bus pins. In this case they can be connected in parallel with the
main ones. Ford/Opel/Volvo and some other ECUs in some cases require putting jumpers or resistors on the
board for password reading in the GPT mode;
в) Delphi and ‘old’ Siemens/Continental do not have passwords.
5) Open the ECU, put the CPU in the BSL mode using either the appropriate manual or taking into
consideration the following data depending on the CPU:
TC1724 - 141-H, 142-L;

TC1728 - 173-H, 174-L;
TC1738/TC1767/TC1782 - 145-L, 167-L, 173-H, 174-L (167-L, 173-H, 174-L are usually enough for Bosch
ECUs);
TC1762/TC1766 - 86-H, 87-L, 88-L, 90-L (87-L are usually enough for Bosch ECUs);
TC1793 - A6-L, B6-H, C8-L (A6-L are usually enough for Bosch ECUs);
TC1796 - A21-H, B21-L, C21-L, D21-L (B21-L are usually enough for Bosch ECUs);
TC1797 - A6-L, A9-L, B6-H, C8-L (A6-L are usually enough for Bosch ECUs);
H is the CPU pin connection to +3.3V via a 470Ω-2kΩ resistor, L is the connection via a similar resistor to the
ECU ground. CPU contacts must not be connected without resistors!
6) Work with the ECU.
Working with the modules
Depending on the operation mode (reading-flashing), you will see the following window:
1) ECU – choose the ECU type which you are going to work with (the list is filled according to the chosen
CPU), the choice determines checksum verification and correction as well as the unlocking function while
writing via OBD;
2) Password – choose a password to be used: a) "Auto" for ECUs without passwords or Bosch ECUs with
TPROT version earlier than 8, b) ‘Browse…’ allows to choose a previously saved file with a password, c) the
latest used file.
3) Automatic power control (L-line switch) – the loading program controls the ECU power via L-line (pin 15).
4) Use write optimizations – writing speedup, in this case those data areas that have not been changed are not
reflashed; you should disable it when some problems appear during the writing process.
5) Disable digital signature check (unlock ECU) – works for the following ECUs: SID, EMS, 17.9.71 and VAG
(and their ‘relatives’).
6) Write only SW areas, skip service areas - for SID, EMS, SIM2K, ME17.9.71 ECUs, the writing result will be
the same as the original protocol writing, i.e. all service areas containing the ECU unique data will be skipped,
and for MED17/EDC17 ECUs Bosch service areas will be skipped even if they do not belong to the OTP
areas.
Important (for ECUs with external FLASH memory): FULL (MICRO+EXT) reading is required for correct
checksum verification and correction. It is impossible to ‘check’ them separately.
Connection instructions
Unfortunately, the developer is unable to make the instructions for all the ECUs, he simply does not have all of
them. The module covers not just one ECU, but hundreds. Some unique ECUs are already described in other
topics. You can find some general information above. Please remember that the module is for professional
use only.
Please consult the following resources:

1) online - https://wiki.obdtuning.de/index.php?tit ... hersteller – pictures the resistors, R3/R4 - GPT1/GPT2
2) online - http://www.evc.de/en/product/bsl/ecu.asp - pictures H points (3.3V via a 1kΩ resistor) and L (ground
via 1kΩ), S1/S2 - GPT1/GPT2
3) Galletto manual
4) K-tag manual, BOOT (grey) - ground via 1kΩ, CNF1 (blue) - 3.3V via a 1kΩ resistor.

Infineon Tricore BSL (Module 53)

Uploaded by

Copyright:

Available Formats

Infineon Tricore BSL (Module 53)

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Infineon Tricore BSL (Module 53)

Uploaded by

Copyright:

Available Formats

Infineon Tricore BSL (Module 53)

The module supports TC1724/1728/1738/1762/1766/1767/1782/1793/1796/1797, as well as 1796+external

The supported ECUs:

TC1762/TC1766 MICRO (1504KB)

The list of successfully tested ECUs:

BMW EDC17CP02 TC1766 TPROT3

1) Remove the ECU;

4) Read the password from the ECU, do as follows:

TC1724 - 141-H, 142-L;

6) Work with the ECU.

Working with the modules

Please consult the following resources:

You might also like