Help: Flashing MCPX, really broken 3 in 1 wanted

coredump · 06-23-2012, 01:54 PM

I want to download some custom firmware into the MCPX
3 in 1, which means, write your own FBL control to have
adjustable tail gain etc.

I have make enough progress understanding how to talk
to the receiver chip. See here:

http://www.helifreak.com/showthread.php?t=427772

I also make a PDI plug to download the firmware into the
atxmega16a4 on the 3 in 1. I can read the device fuse and
lock bits fine. I believe I just need to click "erase device"
and then I will be able to down my own firmware to the 3 in 1.
The catch is that, I will never able to get the original firmware
back.

But it seems such a waste to destory a perfectly working
3 in 1. Here is where I am asking for help.

Does any one has some really broken 3 in 1 board they
don't want so I can buy it cheap? I do mean really broken.
Things like board do not bind is fine by me because I can still
use the MCU to do some programing with the gyro etc.
I can even pull the receiver signal from the good board.

I also perfer the V2 board because V1 board are good for
BL conversion, even broken one has some value to some
of us. If you have a really broken V1 board, I might able to
fix it up for you.

Note: Burning FETs are easy fixable by a few members here.

PM me if you have some broken 3 in 1.

Thanks

cp11 · 06-23-2012, 04:41 PM

Can't you just read the device and save it as a backup, or is it copy protected?

You can always remove the AVR and replace it with a blank one

Drivinfast247 · 06-23-2012, 06:17 PM

My buddy has a board that broke the corner of the pcb.

coredump · 06-23-2012, 08:39 PM

cp11:
As I post on the receiver chip thread, the MCU on 3 in 1 has the lock bit
set to disable all read/write. The only way to download firmware is to erase
the device. It is design to protect the original firmware.

I can replace with a blink one, I even bought a few and clean up the conforming
coating on one of my board. But Still it is a lot of work to take the MCU out
and put a new one back on. Using a broken 3 in 1 is much simpler.

Drivnfast247: Thank you. Will send you PM.

Mega Stumbler · 06-23-2012, 08:41 PM

How many do you want? I think I might have a few.

Sent using Tapatalk. Please forgive/ignore autocorrect errors.

coredump · 06-23-2012, 11:07 PM

Thanks Mega, that is great. If a board is consider broken by you,
it is definitely broken enough for me that I don't feel guilty flashing it.
If possible, I would like to get a few to cover different board revision.
Thanks again.

cp11 · 06-23-2012, 11:50 PM

Too bad about the code protection, but it's expected I guess. Are you writing it in assembly, or C? You should find a tiny speaker and program it to play songs or a siren while you fly!

coredump · 06-24-2012, 02:58 AM

HH will definitely use a MCU that protects their firmware. It is expected.
I am glad it is not like the avr mega series which I need to solder 20 pins
to just erase it. Done that for the walkera ESC.

I will be writing in C and thinking in assembly code that C generates.

I have update some guess about the MCPX debug port in the receiver thread:

http://helifreak.com/showthread.php?t=427772&page=3

coredump · 06-25-2012, 04:27 AM

Here are some notes on mapping the V2 MCU pin out:
I use the port number rather than chip pin number. You need
read the datasheet to map them back to chip pin number.
The port number is easier for programming.

portA:
[0:2] not used. In V1 it is the gyro analog input.
3: motor ground plug. OCP input.
4: monitor battery Vcc/2
5: main motor output voltage measure
6: tail motor output voltage measure
7: MCU voltage monitor (3v /2)

Port B:
0: connect to porta_7, MCU voltage.
[1:3] Not used

Port C
0: I2c data for gyro
1: i2c clock for gyro
2: Debug port serial out
3: Debug port serial in
4: tail motor pwm
5: main motor pwm
6: LED, push to light it.
7: not used.

port D:
0: Right servo PPM
1: Elervation servo PPM
2: Left servo PPM
3: Not used
4: Receiver data interrupt.
5: Receiver data SPI data
6: Gyro Interrupt (That is the line has receiver data plumb into it)
7: Receiver SPI clock

Port E: not used.

06-23-2012, 01:54 PM	#1
coredump Registered Users Join Date: Apr 2009 Location: Bay area, CA	Help: Flashing MCPX, really broken 3 in 1 wanted I want to download some custom firmware into the MCPX 3 in 1, which means, write your own FBL control to have adjustable tail gain etc. I have make enough progress understanding how to talk to the receiver chip. See here: http://www.helifreak.com/showthread.php?t=427772 I also make a PDI plug to download the firmware into the atxmega16a4 on the 3 in 1. I can read the device fuse and lock bits fine. I believe I just need to click "erase device" and then I will be able to down my own firmware to the 3 in 1. The catch is that, I will never able to get the original firmware back. But it seems such a waste to destory a perfectly working 3 in 1. Here is where I am asking for help. Does any one has some really broken 3 in 1 board they don't want so I can buy it cheap? I do mean really broken. Things like board do not bind is fine by me because I can still use the MCU to do some programing with the gyro etc. I can even pull the receiver signal from the good board. I also perfer the V2 board because V1 board are good for BL conversion, even broken one has some value to some of us. If you have a really broken V1 board, I might able to fix it up for you. Note: Burning FETs are easy fixable by a few members here. PM me if you have some broken 3 in 1. Thanks

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

06-23-2012, 04:41 PM	#2
cp11 Registered Users Join Date: Apr 2012 Location: CA	Can't you just read the device and save it as a backup, or is it copy protected? You can always remove the AVR and replace it with a blank one

06-23-2012, 06:17 PM	#3
Drivinfast247 Registered Users Join Date: Jun 2009 Location: Shelby Township, Michigan	My buddy has a board that broke the corner of the pcb.

06-23-2012, 08:39 PM	#4
coredump Registered Users Thread Starter Join Date: Apr 2009 Location: Bay area, CA	cp11: As I post on the receiver chip thread, the MCU on 3 in 1 has the lock bit set to disable all read/write. The only way to download firmware is to erase the device. It is design to protect the original firmware. I can replace with a blink one, I even bought a few and clean up the conforming coating on one of my board. But Still it is a lot of work to take the MCU out and put a new one back on. Using a broken 3 in 1 is much simpler. Drivnfast247: Thank you. Will send you PM.

06-23-2012, 08:41 PM	#5
Mega Stumbler My HF Map location Join Date: Aug 2011 Location: Kansas	How many do you want? I think I might have a few. Sent using Tapatalk. Please forgive/ignore autocorrect errors.

06-23-2012, 11:07 PM	#6
coredump Registered Users Thread Starter Join Date: Apr 2009 Location: Bay area, CA	Thanks Mega, that is great. If a board is consider broken by you, it is definitely broken enough for me that I don't feel guilty flashing it. If possible, I would like to get a few to cover different board revision. Thanks again.

06-23-2012, 11:50 PM	#7
cp11 Registered Users Join Date: Apr 2012 Location: CA	Too bad about the code protection, but it's expected I guess. Are you writing it in assembly, or C? You should find a tiny speaker and program it to play songs or a siren while you fly!

06-24-2012, 02:58 AM	#8
coredump Registered Users Thread Starter Join Date: Apr 2009 Location: Bay area, CA	HH will definitely use a MCU that protects their firmware. It is expected. I am glad it is not like the avr mega series which I need to solder 20 pins to just erase it. Done that for the walkera ESC. I will be writing in C and thinking in assembly code that C generates. I have update some guess about the MCPX debug port in the receiver thread: http://helifreak.com/showthread.php?t=427772&page=3

06-25-2012, 04:27 AM	#9
coredump Registered Users Thread Starter Join Date: Apr 2009 Location: Bay area, CA	Here are some notes on mapping the V2 MCU pin out: I use the port number rather than chip pin number. You need read the datasheet to map them back to chip pin number. The port number is easier for programming. portA: [0:2] not used. In V1 it is the gyro analog input. 3: motor ground plug. OCP input. 4: monitor battery Vcc/2 5: main motor output voltage measure 6: tail motor output voltage measure 7: MCU voltage monitor (3v /2) Port B: 0: connect to porta_7, MCU voltage. [1:3] Not used Port C 0: I2c data for gyro 1: i2c clock for gyro 2: Debug port serial out 3: Debug port serial in 4: tail motor pwm 5: main motor pwm 6: LED, push to light it. 7: not used. port D: 0: Right servo PPM 1: Elervation servo PPM 2: Left servo PPM 3: Not used 4: Receiver data interrupt. 5: Receiver data SPI data 6: Gyro Interrupt (That is the line has receiver data plumb into it) 7: Receiver SPI clock Port E: not used.