Vida CEM swapping

Post by **RickHaleParker** » 27 Jun 2020, 21:35

vtl wrote: 27 Jun 2020, 21:23 The guy is from Poland, be merciful he speaks any English

My old CEM is not responding even to Renesas E8...

Most of the Amiga guys where from Europe. A lot from Germany.

Did you brick the chip?

Around here used CEMs are $22.00 or $37.00 depending on if the clerk thinks they are "Computer Controls" $37.00 or "Computer Control Modules" $22.00. Don't as what the difference between the two terms is. I'm clueless.

Post by **vtl** » 27 Jun 2020, 23:42

Had to split up the E8 and do a basic sanity check of my wiring. Ground pin I used looked suspicious, so had to RTFM

It turns out all ground pins have to be connected, "my" ground pin was indeed ground, but only used for connectivity check, not for signal reference. Wired the rest, and voila: "Version Information: VER.1.16"

Now need to figure out why my ESP32 code does not work. But at least CEM is not fried/bricked. Yet.

ZX-Spectrum hacker here =)

Post by **vtl** » 28 Jun 2020, 02:34

Ok, it works... Tons of problem, starting with CYT1076 level shifter that switches at 100 KHz, but Renesas wants more. Somehow they agreed at 200 KHz, but I may need to redo the shifter. Renesas is 5v, ESP32 is 3.3.

Also finding the right SPI mode was a bit challenging, especially with the previous problems in hands. LSBFIRST and MODE3 is what Renesas wants.

04:33:14.310 -> 0x56 0x45 0x52 0x2e 0x31 0x2e 0x31 0x36 0xff 0xff : VER.1.16⸮⸮

4am, already?

Post by **RickHaleParker** » 28 Jun 2020, 03:04

vtl wrote: 27 Jun 2020, 23:42 ZX-Spectrum hacker here =)

ZX81 was the first computer I bought. Then C= 64. A long line of Amigas. After C= blew it a slow migration to Windows.

shodanx · Post by **shodanx** » 28 Jun 2020, 19:18

@vtl, check out ebay item 264566995629, 2x8 channel level shifter and should do well over 1mhz switching

Does anyone have high resolution scans of each version of the CEM ?

I bought 2x 2006 XC70 with highly suspect CEM. So now that I have two to fix, it is worth my while to learn how to clone and buy a programmer.

I'm looking at that Xprog programmer, I already have a willem 3.? programmer that might work.

From what I understand, CEM cloning is going to involved dumping ROM from two eeprom and two microcontrollers ?
Is dumping the data from the microcontrollers really necessary ? Surely they put all the real config data in the eeprom and the microcontroller just have the code ?

And with that said, is there anywhere that people have been collecting dumps from these microcontrollers and eeproms ?

I'd like to do some changes while I'm at it, I want to add keys, remove the alarm (which is always dead in those old cars anyway), remove the FOUR-C from the configuration...

Post by **vtl** » 29 Jun 2020, 10:49

Good news and bad news. Good news is I'm able to talk to CEM reliably at 57600 or 115200 bauds. Bad news there's no ID code match jitter

The code measures the jitter in base freq. clocks, at 240 MHz it can detect variation in time for lifting the BUSY line as low as 4-5 us. However, collecting entropy in thousands runs I see no jitter. About 5 clocks deviation on average. Sigh...

Either the chip does not have the same BUSY nuance or I need to buy a waveform generator and downclock the chip (it runs at 30 MHz).

Post by **yagger** » 14 Jul 2020, 16:22

How we clone this kind of CEM on the bench.

Post by **vtl** » 15 Jul 2020, 08:27

So, you are finding the ID over CAN withing a few seconds? Means, the range is very narrow. Good to know, thanks!

Post by **yagger** » 15 Jul 2020, 10:53

No, when I show process there are periods with fast forward video.
Detection can take 5 - 15 minutes actually.

Post by **vtl** » 15 Jul 2020, 11:02

This is still fast, given the CAN-bus itself is not very fast.