The greatest thanks all, who tested this program and helped me understand 
			HOW TO DO IT ....

Excuse me for my english, i hope you'll understand, what i wanted to say here ;-)
			
*********************************************************************************
This document has appeared as a result of numerous experiences of my friends, 
it is not 'absolute final true' and is open for changes. The algorithm described below 
in most cases it helped to cure a receiver as is, but sometimes additional manipulations 
were required.
*********************************************************************************



1st of all - you have to know, what flash chips are in your IRD, to have datasheets for
them, and to have an original or other verified _complete_ firmware (i mean firmware
with original bootloader) which you will download into IRD to cure it.
 
Step by step:
Step #0. Optional. Sometimes helps, sometimes prevents. After poweron IRD you go
on the page 'DCU registers', press Start button to start DCU monitor, by clicking on the small green
button near to field Control you call DCU Control register dialogue, check bits
25 and 31,  press Send, stop the  monitor with Stop button.

1. Go to page Miscellaneous, 'Init from file' - select appropriate IRD model. In
addition it is possible to clean the configuration of traps (and for Pace it is
simply necessary step), - press 'Init from file', select 'Clear Traps', thus all
configuration of traps will be cleaned, for check of it it's possible to press
'Check Existing' on the first page, look at the outputted configuration, there
everywhere should be 80000000 (if Clear Traps did not make then there may be
other values). If you see only zero values at this step, it means IRD hangs up because 
you was selected not appropriate EMI initialization algorythm. 
In this case you have to find the original firmware for your IRD model and send it 
to me for extraction of proper EMI initialization algorythm.
  
Remember - you can't read/write external memory before External Memory Interface will be
 initialized properly !!!


2. Look at DCU monitor (Start),  if 25 and 31 are cleared, check them again, 'Stop'
(see the remark to step 0).

3. It's a very important step !!! At this point you download a trap handler, 
which enables the possibility of clearin/programming flash chips. You can't write into 
this chips directly, but via JTAG interface you can download a small program which 
can generate sequences of JEDEC commands necessary for those purposes, and then
force CPU to run this program (it makes via ST20 embedded trap handling algo,
so this program will be called 'trap handler routine').

It's very important that CPU doesn't use the memory area you loaded trap routine 
for other tasks. Below are some indications for selecting of the trap routine address:

- 80000140 (default) - ST20 integrated SRAM - this address is useful for Pace and
DTF-1, Pioneers and DTF-2 with this address most likely will not work, as
processors since Sti5500 and higher may use this area for the data cache, it is
necessary to select any addresses in RAM or videoRAM area.
- BCT-1430, BCT-1530, DTF-1, DTF-2 use address 40000000 as RAM start address, 
and C0000000 as VideoRAM start address. Other IRDs use another memory map.
E.g. Pace-3000 and DTF-3 have only one DRAM chip (with size of 4 MB), mapped to 
C0100000, so we may presume  that RAM start address is C0100000, and VideoRAM start address
is C0300000.

3.1. If you don't know exactly the address where you can safety download the trap handler, 
then you have to search free memory area with size at least 5 kB (the continuose area filled by zeros only or
by 'FF' only). For this purpose it is possible to take advantage of Verify RAM load button 
on page Miscellaneous - it is not necessary to select very large files for tests, 
there is 5-6 kilobytes enough.
 
You can try to look for a free memory on the first page by pressing 
'Find Free Mem' button,  it is useful to clean RAM before it, by filling it with FF. 
There is no a separate button for downloading the file in RAM, it is possible to use  Verify
RAM load button at the last page. For this purpose it is necessary to have the
file with 2 Mbytes length, filled with FF. Such file can be made from any binary
file of suitable size with help of the WinHEX editor. You have to reboot IRD after
filling the RAM.

Do not try to search free memory with 'Find Free Mem' button befor you sure you point proper addresses 
at the appropriated fields !!! The result you'll get in this case may be wrong !!!

3.2. Go to page Hardware Config. 'Trap routine address' - select (or enter) the address for
allocation a trap handler routine.

4. At trap handler parameters  leave checked only Priority - High, Group of
traps - BreakPoint,  load routine (Load Trap Routine button). From the dialogue
which has jumped out select the necessary trap handler. 
For most IRD models try both fl4_trap.bin and  fl4_trap_nochk.bin 
(the second one has no additional algo of programming
verification, it's usefull when the first one prints too much error messages
during programming).
For DTF-2 - if you going to work with the large flash chip (two chips with size 1MB each one, 
mapped into address 7fe00000 - they are connected to data bus as one 32-bits chip, 
the first one - to 0..15 data bits, the second one - to 16..31 data bus lines)
you have to use dtf2_trap_fin.bin. 

5. Click 'Install Traps'

6. Click 'Take trap'

7. DCU monitor -> Start - Look at DCU monitor, if Control=60000, then Stop and
step 8. Else try another address for allocation of trap handler.
The same information you can get without DCU monitor - if you take a look at trace window,
you can find a record 'DCU_CONTROL 00060000' - it may say you that trap is taken
successful and trap routine is started.
 
At this moment very useful to go to last page and click 'Verify trap handler', after successful
verification trap handler will be work more stable (I don't know - WHY, but skills of my 
friends and me confirm it) 

8. If all are OK, then usually I recommend Clear Flash, Write from file ( length
of file must be 200000 (2Mb)). If you have not such file i don't know how you
will cure your IRD :-((( It is possible only if last 512 kbytes of your flash
chip leave unchanged and firmware you will download is compatible with leaved
part.
There is only one flash chip in some IRD models, which keeps both firmware and settings 
(Channels/transponders tables, patches, etc.) In this case you need firmware with
length of 1,5 MB, and you have to program it from address 7fe80000. You may not clear whole
chip in this case, but if you'll do it there will be not something wrong.
 
In some cases clearing of chip fails, so you have to erase separately each sector 
from 7FE00000 to 7FF7FFFF (see at chip datasheet for proper sectors offsets).  
E.g. chip sectors addresses may be 7FE00000, 7FE10000, 7FE20000, 7FE30000,...,
7FE90000, 7FEA0000, 7FEB0000, ... , 7FEF0000, 7FF00000, 7FF10000, ... ,
7FF70000. Put this values in any order in the  field Sector address, click Clear
sector. When done, put 7FE00000 in the From Address field, Data lenth = 0 and
File offset = 0, click Write from file.

If  the error jumps out during flash programming, there is no necessity to erase
all chip again and to program it from the beginning. It is necessary to notice
the address on which programming has stopped and to place appropriate value in
field File Offset. For example, programming has interrupted on 7FEE4000 address:
we set following values - From Address: 7FE00000, Data length: 0 (it means, that
we shall write up to the end of the chip or up to the end of the file), File
Offset: E3000 (it means, that E2FFF byte in the file and in the chip will be
skipped, and we shall write from 7FEE3000 address). Why E3000 instead of E4000?
Well, on some case ;-). If  there is a write error on the same place again,
probably it is necessary to erase this sector and to program from the beginning
of sector.   


If something wrong, i'm waiting for a log (mailto:ivanov_dv@izvestia.ru) You may right
click at trace window, 'Select all', 'Copy' and then 'Past' to get a log.

That's all... Good luck !!!