Flashhack – LT1/P66 error recovery

Although uncommon, when the flash procedure has failed for your LT1 or P66 ECM, there are several things you can do to ensure successful recovery.  As you are probably aware, until a complete and successful reflash procedure, your ECM will be rendered unusable and your car will not run.

These steps should be fairly rare as flashhack automatically retries from a logical place in the procedure when there’s a failure (which should automatically recover from the issue)

What NOT to do

Lets start with what NOT to do after your flash write has failed, until you figure out what to do:

  • Do not use any function in flashhack other than ‘Write Calibration’.  Clicking ‘Read Calibration’ or ‘Unload Kernel’ may result in a bricked ECM at this point, as these procedures generally reboot the ECM, and right now you don’t have anything to boot.
  • Do not load a different flash tool or anything else that connects to your ALDL port (including dataloggers) and try to recover using that.  Trust me on this, if you were using another flash tool, there would be no hope at this point anyway.
  • Do not turn your key off, remove power from your ECM, or let your car battery die or drop to a low voltage.  Maintaining power to PCM IGN and PCM BAT is critical until the recovery is complete.

Current ECM State

It might be useful to determine what state your ECM and your flash tool (computer) is in before proceeding, you can usually do that based on the last message printed in your log when it has failed, so lets talk about how the flash procedure works.

It’s worth mentioning, if you aren’t aware already, that these ECMs are actually two separate ECMs in one box.  The flash procedure is run for each one, that’s why it appears we’re doing most things twice.  There are also two bin files, but LT1 tuning software generally stacks them into one.  GM calls the two sides TSIDE (time side) and ESIDE (event side)

Because flashhack writes one side of the ECM at a time, if your flash write has failed, only one half of the ECM must be recovered.

The normal flash write procedure that flashhack uses (for each side) is:

  1. Check if the kernel is already running.  If not:
    1. Unlock the ECM security and enter reprogramming mode (which allows us to execute any code we want)
    2. Upload and run the kernel, this stops executing any code on the eeprom (that we are about to rewrite) and instead runs a tiny operating system from ECM RAM.
    3. Upload a set of programs and subroutines that we’re going to use during the reflash procedure
  2. Quickly check your bin against the one already loaded into the ECM to see if it’s already complete (no point in flashing the exact same thing again)
  3. Run the erase program on the ECM, which both erases and verifies the eeprom, and ensure it completes
  4. Run the write program on the ECM, which allows us to upload chunks of the bin until complete
  5. Verify the bin was written completely

If it has at any point failed during or after an ERASE procedure (Step 3-5), you should proceed with caution.  You must complete a successful flash before doing anything else.

If ECM power has been lost during a flash procedure on an LT1, and the recovery rom was installed, you should reconnect power and try again now.  There is a small chance the recovery rom was not completely installed due to the exact moment that the power loss occurred, in which case your ECM will not recover.

What to do?

This assumes the ECM is in a recoverable state.  Either the kernel is loaded, or we are booted from the recovery rom.

First off, if for some reason flashhack itself or your laptop has crashed, you should restart the program at this point.  If you are suspicious some bug in flashhack has caused the failure, it might also be a good idea to restart the program now so you are starting fresh.  Also, make sure you are running the most current version.

Optional: Since we aren’t sure why it failed, and we don’t know how stable your computer, interface, or ECM is, if you know which side we’re failing on (TSIDE or ESIDE), you could disable flashing the OTHER side for now (go into parameters and uncheck ‘write ESIDE’ or ‘write TSIDE’), and just focus on getting your ECM bootable.  Make sure to re-check that box afterwards.

No matter what the failure, the only thing you can do is press ‘Write Calibration’ again.  This should return to the first step, detect that the kernel is already running, and retry the procedure.

To assist in getting a good clean ALDL bus, make sure your battery is fully charged, and disconnect any battery chargers from your vehicle.  Remove any other sources of electrical noise, turn off any accessories in your vehicle such as stereos or fans.  Unplug your laptop charger if you’re using one.

If you see communication errors, you may have an issue with your interface or connection to the ALDL port.  There also may be a device on your ALDL bus (such as a body control module) which is malfunctioning and making it difficult to communicate.  Many devices often share the ALDL bus.

One thing you might not realize, provided you maintain power to the ECM, is that this is a safe time to restart flashhack, try a different ALDL interface, or even install flashhack on a different computer.

You may even want to order a new or better ALDL interface online and try again when it arrives, provided you can maintain power until then with a battery charger.

If many attempts, different serial interfaces and computers have failed to complete the flash write, it’s possible that your vehicle wiring is faulty.  If that is the case, it’s also possible ECM is still in a recoverable state despite the repeated failures.  If the erase procedure has completed and the first ~10% of the bin has been written, and the recovery rom was successfully installed, you should be able to safely power the ECM off, remove it from the car, and construct a bench flashing setup or move it to another vehicle.