cancel
Showing results for 
Search instead for 
Did you mean: 

Finding JTAG/SWD location on custom PCB

Goat-Boat
Associate

Hey ST Community,

A little bit of background knowledge. Aside from a few Arduino/microcontroller courses in college I am relatively new to coding and MCUs, specifically the ARM format. I currently work in the heavy machinery segment and am trouble shooting some emulators that are giving me issue with my personal machines.

The pictures below are of the custom PCB that lives inside of an epoxy block. In its finished form, there are pins out the bottom to connect the to the part of the sensor interface of heavy machinery. Based on the numbers and letters on the MCU it is a STM32F405 with 64 pins. (***Note: I am aware this board is damaged but  I can remove an identical, intact board when it comes to testing time***). I have an ST-Link V3 Set coming in the mail and I am looking for advice on connecting to this board.

This is an emulator that can plug in to the harness and "emulate" certain aspects of heavy machinery tunes so we are able to adjust other sensors/values/parts to get the ideal performance/efficiency/remove bugs. It communicates with the vehicles ECM through the standard J1939 CAN bus.

The issue is that while we can read and copy the CAN bus data, the board runs an algorithm for emulating the "OEM+" CAN bus values and that occasionally throws codes or cuts power to the machine. From the research I've done there is no way to go backwards from CAN bus data to hard code. Additionally, this is an old-ish piece of "proprietary" tech from a now defunct small company with no open source code available.

As it works the majority of the time I believe it is hardware issue due to the high heat and vibration experiences by construction equipment. My goal is to copy whatever is possible from this chip and board so I can then reupload it to a more robust PCB system and potentially edit it there if need be.

Based on forum browsing, the STM reference and the AN sheet my ST-Link needs to be connected to SWDIO (PA13, pin 46) and SWCLK (PA14, pin 49) and then possibly put into bootloader mode with the BOOT0 pin (which is intact on the MCU). My first question: how do I identify those pins on the board and will I have to wire directly to the MCU?

Provided I can establish a connection with the ST-Link, what is my next step for copying the contents of the board? I know I need to use STM32cube and possibly OpenOCD but I am unsure in what configuration. I've been through GitHub looking for the puzzle pieces but frankly everything could be in ancient Greek.

Time isn't a huge issue as the machines run most of when I need them and I've been through college level mech eng so I've got a decent base knowledge of things and a penchant for hard work. Also the majority of the work will be done with a new XPS15, i9 and Windows 11 Home (23H2).

Thanks in advance,

Mason

20240502_094956.jpg 

20240502_091123.jpg

4 REPLIES 4

You might have to trace wires, and use a multi-meter to confirm continuity.

The low 48-pin device looks like an STM32F103 part is that doing CAN or USB connection?

That lower 3-pin group look to be PA13, PA14 from the F1, and the next 3-pin group PA13, PA14 from the F4

Tips, Buy me a coffee, or three.. PayPal Venmo
Up vote any posts that you find helpful, it shows what's working..

As far as I know it is for the CAN as there is no USB on the board, unless there are pins for me to connect an external USB. I see what you mean about the 3-pin groups, but I struggle to understand the difference in what data I'll be able to pull. Apologies for the uninformed question but will I have two sets of everything, one for each of the MCUs or is there a spot on the board where they will cross over and I can receive complied data from both?

You'll need a Ground pin, and find a 3V3 VCC pin, but should be able to connect a ST-LINK or J-LINK debugger. Try connecting via STM32 Cube Programmer. Chances are the devices are Read-Protected.

The 8 MHz crystal on the F4 looks to be destroyed.

20240502_094956_mrkup_001.jpg

Tips, Buy me a coffee, or three.. PayPal Venmo
Up vote any posts that you find helpful, it shows what's working..

On the back side you've got 3x TJA1050, so 3x CAN busses

https://www.nxp.com/products/interfaces/can-transceivers/can-with-flexible-data-rate/high-speed-can-transceiver:TJA1051

I'd assume 2x connected to the F4, and 1x to the F1

Not sure how and to what each connect. The firmware likely collects data, perhaps runs some algorithm. You'd have to recover the code from both an reverse-engineer / disassemble. If firmware updates are available perhaps you could review those.

Will be a non-trivial exercise

Back side also has regulator / power supply circuit.

The 8-pin connector site, bottom, left to right

POWER, CAN_A_H/L, CAN_B_H/L, CAN_C_H/L, GROUND

Tips, Buy me a coffee, or three.. PayPal Venmo
Up vote any posts that you find helpful, it shows what's working..