TI DSP C2000 firmware cloning  - Page 1
Forum section: electronics / general

author: inquisitor
author_rank: Contributor
timestamp: April 18, 2025, 05:24:56 am
content: Dear Community,Could someone advice me on cheapest way for cloning the firmware on TMS320F2811,so far as i know the firmware is not protected by any password ,i am attemping to replace the EV tree Phase motor controller "sevcon gen4" therefore i will need exactly one copy of DSP.Couple years ago i used for similar project software called "flasher c2000" plus debugger JTAG-JET by Signum electronic, Unfortunately i selled the debugger on ebay New one will cost 1500usd .One option will be to buy xds510 from Aliexpress but i am not sure if would work with code composer 3.0 ,also i think it would be very difficult to get a old version of Code composer,the dsp has alredy 14pin jtag interface. thank you for any Support

author: MitjaN
author_rank: Contributor
timestamp: April 18, 2025, 06:46:56 am
content: You could use XDS100 either with Code Composer Studio or Uniflash tool. Both should support XDS100 and TMS320F2811.With a bit of improvisation you can use XDS100 that is build into various LaunchPads (28027 was the cheapest one, but I am not sure that you can still get it)Or you can build XDS100 yourself as it is just a FDTI chip with an external eeprom.

author: inquisitor
author_rank: Contributor
timestamp: April 18, 2025, 07:40:36 am
content: Thank you mitjaN ,i can buy clone xds510 for 60usd but not sure if will works with Uniflash tool, also i didn't find any possibility to download either the uniflash tool nor the code composer 3.0 ,i found on ebay uk Launch pads picollo 28027f for 70eur including shipping ,should i go with 28027f ?

author: inquisitor
author_rank: Contributor
timestamp: April 18, 2025, 07:59:18 am
content: What kind of improvisation is necessary to get the xds100 connected to DSP, you mean 14pin jtag cable?

author: aeg
author_rank: Regular Contributor
timestamp: April 18, 2025, 08:26:07 am
content: XDS110 standalone probe should be cheaper than that. C2000 is on the device support list, but I've never tried it.Here is Uniflash:https://www.ti.com/tool/download/UNIFLASH

author: inquisitor
author_rank: Contributor
timestamp: April 18, 2025, 08:58:49 am
content: thank you aeg ,also for the link ,i will order xds110 standalone ,i hope this one would work

author: inquisitor
author_rank: Contributor
timestamp: April 18, 2025, 09:09:45 am
content: Just for my knowledge, the signum jtagjet x1 according to attached Screenshot should also support c2000 dsp?

author: StarLight
author_rank: Newbie
timestamp: April 18, 2025, 01:04:36 pm
content: The new version of CCS software fully supports the export of binary programming files. Recommending CCS12.8.1. you can connect the DSP and choose export hex or other files.as for debuger, you can choose the one below, it supports 14-pin jtag

author: inquisitor
author_rank: Contributor
timestamp: April 18, 2025, 01:16:48 pm
content: Quote from: StarLight on April 18, 2025, 01:04:36 pmThank you very much good to know i already ordered xds110

author: inquisitor
author_rank: Contributor
timestamp: April 30, 2025, 02:28:41 pm
content: Finally i received my xds110 unfortunately as soon i connect the debugger to my devices the interface is disappearing on Uniflash Monitor no matter wheather the target devices are separately powered or not ,in my opinions there must be some cable interruption or the jtag is not correctly (,the pinouts are wrong.) Could be because i extended the cable because the target devices has jtag 14pin pitch 2,0mm and the xds110 pitch 2,54mm ? maybe the pinouts on jtag plugs are differenntly ?

author: inquisitor
author_rank: Contributor
timestamp: April 30, 2025, 02:31:20 pm
content: extended cable

author: inquisitor
author_rank: Contributor
timestamp: April 30, 2025, 02:38:16 pm
content: It is Very likely that this cable has a different pinouts as jtag 14pin ,any suggestion regarding the pitch 2,0mm to pitch 2,54mm adapter?

author: daisizhou
author_rank: Super Contributor
timestamp: April 30, 2025, 11:31:03 pm
content: Quote from: inquisitor on April 18, 2025, 05:24:56 amIt seems like you have encountered similar difficulties as me.The one I encountered is a TMS320F2812. According to the information, it is password protected.The chip is shown in the figure below. There is also a 14-pin interface on the PCB board.https://www.eevblog.com/forum/microcontrollers/ask-for-help-on-how-to-write-firmware-to-dsp-chip/msg5071042/#msg5071042

author: inquisitor
author_rank: Contributor
timestamp: May 02, 2025, 02:54:28 pm
content: I don’t think so my 2811 doesn’t have protection, could anyone advice me what kind a start and end address i need to set here? the problem with cable is resolved i need only to export the file

author: inquisitor
author_rank: Contributor
timestamp: May 03, 2025, 10:33:41 am
content: Quote from: daisizhou on April 30, 2025, 11:31:03 pmEven if has read protection you can use services like russian semi Research or ic cracker they are able to Bypass protection

author: inquisitor
author_rank: Contributor
timestamp: May 08, 2025, 06:09:16 pm
content: The problem is solved ,thankful to Oleg eevblog. member, attached start and end address for TMS320F2811

author: danpshyco
author_rank: Contributor
timestamp: May 09, 2025, 11:06:19 am
content: Hy.I have the same controller Sevcon Gen 4 totally dead after a firmware update.......dld was not for him.Can u help me with cable connections? Did u manage to save the hex file and write another one?.If i can ask you for a firmware that work without any CAN meseges only the Throttle Motor Encoder FW and REW switch,everythink else doesn,t matter for me.Thanks for your real help

author: danpshyco
author_rank: Contributor
timestamp: May 09, 2025, 11:11:36 am
content: And by the way i arlready have this interface TMS320-XDS100-V3.Could work?

author: inquisitor
author_rank: Contributor
timestamp: May 09, 2025, 01:32:03 pm
content: Attached Binary from TMS320F2811 ,xds100 v3 never tried you have to test it

author: rsjsouza
author_rank: Super Contributor
timestamp: May 09, 2025, 01:43:56 pm
content: Quote from: danpshyco on May 09, 2025, 11:11:36 amXDS100v3 is compatible with C2000 and the TI tools (Uniflash, CCS, etc.)

author: danpshyco
author_rank: Contributor
timestamp: May 09, 2025, 08:34:31 pm
content: Where is the attached file?

author: inquisitor
author_rank: Contributor
timestamp: May 10, 2025, 06:22:33 am
content: The platform doesn’t support Binary file, can be posted only as ziphttps://app.box.com/s/ju89lok9t4aol49lhwoy5covmwv6bnau

author: danpshyco
author_rank: Contributor
timestamp: May 10, 2025, 02:08:58 pm
content: Can u tell me please how you read it? What memory zone you bypass? I a newbie with this kind of dsp.I read in some posts cause the processor has OTP zone and if u rewrite that zone the bootloader doesnt work anymore.You read from 0x3F 6000 until 0x3D 9FFF? How you bypass 0x3F 7FF6 / 0x3F 7FF7 and 0x3F 7FF8 / 0x3F 7FFF? When you readit the Sevcon mainboard was powered? The PD pin has 3.3 V ? You used 2k2 resistors between EMU0 and EMU1 to Vddio and 2k2 TRST to ground? When you moved to the other controller was functional? You cloned even the eeporm 24lc640 memory?

author: inquisitor
author_rank: Contributor
timestamp: May 10, 2025, 07:01:00 pm
content: Check my previous attachment start and end address, you have to power the sevcon up ,didn't used any resistor i managed to write the Binary back to dsp ,i tried to read eeprom 25lc640 i will need copy of this Binary as well because of immobilizer, the problem is the cheap China programmer like xgecu can’t read the file properly when the mcu and eeprom is running, i am getting only empty file from eeprom and i can write only empty file to 25lc640 otherwise is displays some address errors ,either i have to buy good chinese programmer like xeltek superpro 6100n or i have to separate pcb and mosfets from cooler remove the eeprom and read there is no other options currently

author: inquisitor
author_rank: Contributor
timestamp: May 10, 2025, 07:15:37 pm
content: I read in some posts cause the processor has OTP zone and if u rewrite that zone the bootloader doesnt work anymore.I don’t know who is posting this garbage

author: danpshyco
author_rank: Contributor
timestamp: May 10, 2025, 08:18:25 pm
content: So....it,s enought to put start adress 0x3D 8000 and the end adress 03xF 7FFF ?

author: abyrvalg
author_rank: Frequent Contributor
timestamp: May 11, 2025, 12:49:26 pm
content: EEPROM reading from running system: try holding the DSP in reset during read (short nRST to GND, both should be present on the DSP programming connector).

author: inquisitor
author_rank: Contributor
timestamp: May 11, 2025, 04:11:22 pm
content: Yeh start and end address should be enough,,i burned the DSP accidentelly up ,one of VCC 3,3v wire goes to programmer was shorted to GND ,the mcu is now death,it take over 600mA current ,i will replace DSP and programmed New, sevcon is the biggest garbage ever seen

author: inquisitor
author_rank: Contributor
timestamp: May 11, 2025, 04:22:56 pm
content: Quote from: abyrvalg on May 11, 2025, 12:49:26 pmThere is no file on eeprom i removed and placed in programmer same issue

author: danpshyco
author_rank: Contributor
timestamp: May 11, 2025, 07:06:08 pm
content: Probably the EEPROM is death too.The EEPROM contain information about motor immobilizer and parameters, it cannot be empty.Or maybe when you try to reflash the mcu everithink is erased from security reason .......reverse engineer proected ......maybe

author: danpshyco
author_rank: Contributor
timestamp: May 11, 2025, 07:09:43 pm
content: Tommorow i will try ,if i have time, to write the hex file that you give me in a bricked Sevcon.I keep u updated if it worked or not

author: danpshyco
author_rank: Contributor
timestamp: May 11, 2025, 07:12:41 pm
content: i attached a link with a Twizy Sevcon Immo offhttps://www.twizy-forum.de/werkstatt-twizy/91865-sevcon-immobilizer-verlog

author: inquisitor
author_rank: Contributor
timestamp: May 12, 2025, 05:38:00 am
content: Quote from: danpshyco on May 11, 2025, 07:12:41 pmI know this guy from twizy forum i have contact with him he find for me some broken twizy charger i will repair it and keep it as Backup, a very friendful guy it is not common in this time, regarding the immobilizer i have working sevcon in my wife twizy i will make a copy i bought this broken sevcon from uk and i was thinking it was in working condition because the led on sevcon flashes 5x but i realised that the eeprom was broken you can read and Flash only empty file on it means something with Flash sequences is wrong

author: danpshyco
author_rank: Contributor
timestamp: May 13, 2025, 11:18:43 am
content: I have a Sevcon Twizy controller until 2016 password unlocked.If you know that guy can you ask him for memory dump 25lc640 Twizy 80 with arduino immo? I want to put this controller on a microcar Aixam with defective Sevcon without any CAN communications.Thanks

author: inquisitor
author_rank: Contributor
timestamp: May 13, 2025, 03:31:21 pm
content: https://app.box.com/s/pxz0v0x15q3odi8ouft7cqf8a2xxf538I advice you to use either the Blackhawk 200 or even jtagjet c2000 i used jtagjet couple years ago and is very stable, reight now i am using Blackhawk, i sell myxds110 because it doesn’t work properly

author: danpshyco
author_rank: Contributor
timestamp: May 14, 2025, 10:45:46 am
content: Those interfaces cost o lot of money.....the controller repair does not worth it.......maybe if u want to help me i send to you the 2 controllers and i pay for your service ......of course if u give me the correct price.Thanks, Or maybe you can rent it to me the Blackhawk USB

author: danpshyco
author_rank: Contributor
timestamp: May 14, 2025, 12:57:38 pm
content: I find that and i buyedhttps://www.ebay.com/itm/306179097057

author: inquisitor
author_rank: Contributor
timestamp: May 14, 2025, 05:22:19 pm
content: Very cheap, try to use blackhawk

author: danpshyco
author_rank: Contributor
timestamp: May 17, 2025, 09:27:30 pm
content: Did u have some schematics with pinout for Twizy Sevcon? I saw that the pin 5 is used for IMMO but i don.t know the rest of the pins like ECU OK and others.Do u know if the throttle is connected 0-5V directly on Sevcon?

author: inquisitor
author_rank: Contributor
timestamp: May 18, 2025, 04:57:56 pm
content: francly i didn't analysed these outputs, i just want to prepare one sevcon and one charger as Backup for my wifes twizy

author: danpshyco
author_rank: Contributor
timestamp: May 19, 2025, 04:53:52 pm
content: Today i.am very happy.My Sevcon is alive now and communicate with IXXAT. I use the XDA100 v3 with success. Your bin dump didn.t work for me.I read the entire flash from adress 0x3D9FFF until 0x3F7FFF with Uniflash.When i write the flash i put in Program Flash the last adress 0x3D9FFF like start flashing adress and it worked just fine.Thanks for the real help

author: abyrvalg
author_rank: Frequent Contributor
timestamp: May 20, 2025, 11:21:35 am
content: The flash is divided into several logical areas:3D8000-3D9FFF - NVM block 03DA000-3DBFFF - NVM block 13DC000-3F5FFF - application3F6000-3F7FFF - bootloader

author: inquisitor
author_rank: Contributor
timestamp: May 20, 2025, 04:29:08 pm
content: I don’t see any reason why the bin file didn't worked it was from working sevcon?

author: danpshyco
author_rank: Contributor
timestamp: May 21, 2025, 05:57:54 am
content: I told you that your bin file din.t work for me.I copied one of my working controller into Twizy controller.Everithink worked like a charm.Thanks very much

author: inquisitor
author_rank: Contributor
timestamp: June 05, 2025, 08:44:51 am
content: Does anyone has any Idea what could cause the issue,i replaced the DSP this i a second one but the microcontroller doesen't take the power at all only 0,1w ,the 3,3v and 1,8v voltage are present, maybe it is fake mcu from china, when the dsp is powered by power supply IC the current is increasing and sloping down like if is there anything shorted but is not