The greatest thanks all, who tested this program and helped me understand HOW TO DO IT .... Excuse me for my english, i hope you'll understand, what i wanted to say here ;-) ********************************************************************************* This document has appeared as a result of numerous experiences of my friends, it is not 'absolute final true' and is open for changes. The algorithm described below in most cases it helped to cure a receiver as is, but sometimes additional manipulations were required. ********************************************************************************* 1st of all - you have to know, what flash chips are in your IRD, to have datasheets for them, and to have an original or other verified _complete_ firmware (i mean firmware with original bootloader) which you will download into IRD to cure it. Step by step: Step #0. Optional. Sometimes helps, sometimes prevents. After poweron IRD you go on the page 'DCU registers', press Start button to start DCU monitor, by clicking on the small green button near to field Control you call DCU Control register dialogue, check bits 25 and 31, press Send, stop the monitor with Stop button. 1. Go to page Miscellaneous, 'Init from file' - select appropriate IRD model. In addition it is possible to clean the configuration of traps (and for Pace it is simply necessary step), - press 'Init from file', select 'Clear Traps', thus all configuration of traps will be cleaned, for check of it it's possible to press 'Check Existing' on the first page, look at the outputted configuration, there everywhere should be 80000000 (if Clear Traps did not make then there may be other values). If you see only zero values at this step, it means IRD hangs up because you was selected not appropriate EMI initialization algorythm. In this case you have to find the original firmware for your IRD model and send it to me for extraction of proper EMI initialization algorythm. Remember - you can't read/write external memory before External Memory Interface will be initialized properly !!! 2. Look at DCU monitor (Start), if 25 and 31 are cleared, check them again, 'Stop' (see the remark to step 0). 3. It's a very important step !!! At this point you download a trap handler, which enables the possibility of clearin/programming flash chips. You can't write into this chips directly, but via JTAG interface you can download a small program which can generate sequences of JEDEC commands necessary for those purposes, and then force CPU to run this program (it makes via ST20 embedded trap handling algo, so this program will be called 'trap handler routine'). It's very important that CPU doesn't use the memory area you loaded trap routine for other tasks. Below are some indications for selecting of the trap routine address: - 80000140 (default) - ST20 integrated SRAM - this address is useful for Pace and DTF-1, Pioneers and DTF-2 with this address most likely will not work, as processors since Sti5500 and higher may use this area for the data cache, it is necessary to select any addresses in RAM or videoRAM area. - BCT-1430, BCT-1530, DTF-1, DTF-2 use address 40000000 as RAM start address, and C0000000 as VideoRAM start address. Other IRDs use another memory map. E.g. Pace-3000 and DTF-3 have only one DRAM chip (with size of 4 MB), mapped to C0100000, so we may presume that RAM start address is C0100000, and VideoRAM start address is C0300000. 3.1. If you don't know exactly the address where you can safety download the trap handler, then you have to search free memory area with size at least 5 kB (the continuose area filled by zeros only or by 'FF' only). For this purpose it is possible to take advantage of Verify RAM load button on page Miscellaneous - it is not necessary to select very large files for tests, there is 5-6 kilobytes enough. You can try to look for a free memory on the first page by pressing 'Find Free Mem' button, it is useful to clean RAM before it, by filling it with FF. There is no a separate button for downloading the file in RAM, it is possible to use Verify RAM load button at the last page. For this purpose it is necessary to have the file with 2 Mbytes length, filled with FF. Such file can be made from any binary file of suitable size with help of the WinHEX editor. You have to reboot IRD after filling the RAM. Do not try to search free memory with 'Find Free Mem' button befor you sure you point proper addresses at the appropriated fields !!! The result you'll get in this case may be wrong !!! 3.2. Go to page Hardware Config. 'Trap routine address' - select (or enter) the address for allocation a trap handler routine. 4. At trap handler parameters leave checked only Priority - High, Group of traps - BreakPoint, load routine (Load Trap Routine button). From the dialogue which has jumped out select the necessary trap handler. For most IRD models try both fl4_trap.bin and fl4_trap_nochk.bin (the second one has no additional algo of programming verification, it's usefull when the first one prints too much error messages during programming). For DTF-2 - if you going to work with the large flash chip (two chips with size 1MB each one, mapped into address 7fe00000 - they are connected to data bus as one 32-bits chip, the first one - to 0..15 data bits, the second one - to 16..31 data bus lines) you have to use dtf2_trap_fin.bin. 5. Click 'Install Traps' 6. Click 'Take trap' 7. DCU monitor -> Start - Look at DCU monitor, if Control=60000, then Stop and step 8. Else try another address for allocation of trap handler. The same information you can get without DCU monitor - if you take a look at trace window, you can find a record 'DCU_CONTROL 00060000' - it may say you that trap is taken successful and trap routine is started. At this moment very useful to go to last page and click 'Verify trap handler', after successful verification trap handler will be work more stable (I don't know - WHY, but skills of my friends and me confirm it) 8. If all are OK, then usually I recommend Clear Flash, Write from file ( length of file must be 200000 (2Mb)). If you have not such file i don't know how you will cure your IRD :-((( It is possible only if last 512 kbytes of your flash chip leave unchanged and firmware you will download is compatible with leaved part. There is only one flash chip in some IRD models, which keeps both firmware and settings (Channels/transponders tables, patches, etc.) In this case you need firmware with length of 1,5 MB, and you have to program it from address 7fe80000. You may not clear whole chip in this case, but if you'll do it there will be not something wrong. In some cases clearing of chip fails, so you have to erase separately each sector from 7FE00000 to 7FF7FFFF (see at chip datasheet for proper sectors offsets). E.g. chip sectors addresses may be 7FE00000, 7FE10000, 7FE20000, 7FE30000,..., 7FE90000, 7FEA0000, 7FEB0000, ... , 7FEF0000, 7FF00000, 7FF10000, ... , 7FF70000. Put this values in any order in the field Sector address, click Clear sector. When done, put 7FE00000 in the From Address field, Data lenth = 0 and File offset = 0, click Write from file. If the error jumps out during flash programming, there is no necessity to erase all chip again and to program it from the beginning. It is necessary to notice the address on which programming has stopped and to place appropriate value in field File Offset. For example, programming has interrupted on 7FEE4000 address: we set following values - From Address: 7FE00000, Data length: 0 (it means, that we shall write up to the end of the chip or up to the end of the file), File Offset: E3000 (it means, that E2FFF byte in the file and in the chip will be skipped, and we shall write from 7FEE3000 address). Why E3000 instead of E4000? Well, on some case ;-). If there is a write error on the same place again, probably it is necessary to erase this sector and to program from the beginning of sector. If something wrong, i'm waiting for a log (mailto:ivanov_dv@izvestia.ru) You may right click at trace window, 'Select all', 'Copy' and then 'Past' to get a log. That's all... Good luck !!!