Vida CEM swapping

[vtl]

Yes. And this: viewtopic.php?p=575090#p575090

Get both versions of m16c-flasher.de, beta can read, release can write Add next to the config file:

[Controller]
Name=M32C@0xFC0000
Group=Generic
BaseAdr=FC0000
Blocks=1
From=FC0000
Size=40000
[end]

And select this controller in the menu.

[gooroo]

Thanks vtl, so to clarify....

Add this to the M16C config file
[Controller]
Name=M32C@0xFC0000
Group=Generic
BaseAdr=FC0000
Blocks=1
From=FC0000
Size=40000
[end]

This will enable you to choose M32C@0xFC0000 from the controller menu

1. Connect USB<>TTL adapter (4 wires) to TX,RX,GND,+5v (VCC)

2. Power to CEM P2 (connect +12V to pin 8 and 15 of connector 'D')
Is this required and if so I need to connect 0V on connector D somewhere???)

3. Connect Busy(HOLD) to GND
4. Connect CNVss to +5v (VCC)
5. To reset CEM switch RESET from +5v to GND and back ro +5V

Within the M16C program....

1. Click "Settings", select your port and 57600 baud
2. Click "Terminal" and select 57600 baud
3. Click "Send" (top "send" button) against any #00 byte, do it until the CEM replies "B0"
4. Click "Close"
5. Click "Connect"

Use the beta version to read
Use the release version to write

Regards

[vtl]

Better 1, 3, 4 and only then apply power (configure CNVss and HOLD before applying any power).

Yes, you absolutely need a common GND between CEM, power supply and USB-TTL.

[RickHaleParker]

1. Connect USB<>TTL adapter (4 wires) to TX,RX,GND,+5v (VCC)

If I recall correctly, you need to Null modem TX & RX between the TTL adapter the the MCU.
At least that what I recall from T5Luke's insrtuctions.

Null modem wiring is like this.

[RickHaleParker]

Yes. And this: viewtopic.php?p=575090#p575090

Get both versions of m16c-flasher.de, beta can read, release can write Add next to the config file:

[Controller]
Name=M32C@0xFC0000
Group=Generic
BaseAdr=FC0000
Blocks=1
From=FC0000
Size=40000
[end]

And select this controller in the menu.

Doesn't that go in MCU.ini not M16C-Ctrl.cfg

[MMehmecke]

Good day

My name is Michael and I'm brand new here, unfortunately the language has to be translated for me. I myself drive a Volvo V50 2005 with the P1 and would try to crack it because I already had a total breakdown!

I've read a lot here in the forum and looked at a lot of circuit diagrams and the Tennsy 4.0 is used 99.9% of the time. My question to you, which circuit diagram is the right one for me? I always read 3.3volt or 5.0volt VIDA says: Diagnostic communication (CAN_L) for the low-speed network The voltage is 1.5-2.5 V during communication
Diagnostic communication (CAN_H) for the low-speed network. The voltage is 2.0-3.5V during communication!

I took a picture of my CEM in the car as it is now from 2019. I thank you in advance for your time.

[vtl]

The one in VIDA, with the CEM pinout, is correct. Some dozens pages back there's also a picture with the P1 CEM wiring for cracker. You may have seen it already.

You want CAN-L, which does not go over 2.5v, or you risk frying the Teensy, which is 3.3v tolerant.

Use the latest code: @mikeak2001 figured out just a few days ago that the byte order is different for his CEM with the same part number like yours (31327215). Can be true for other newer P1 CEMs as well.

[vtl]

Well, early P2 is getting more entertaining Found the pin compare routine, however it has a "flaw": it compares bytes one by one, resets the "matched" flag if the bytes differ and continues to the next position. At the end it checks that "matched" flag. So our algo does not work, because it expects pin compare routine to return with failure as soon as mismatch is detected.

[vtl]

Looking at instructions timing: https://oldwww.nvg.ntnu.no/amiga/MC680x ... iming.HTML

We have execution flow varying in 2 instructions only for match/not-match case in every pin position. Unless I found wrong timings, every incorrect byte adds only 2 CPU cycles. To detect that with any statistical significance we would need to sample a lot and a lot!

Code: Select all

;; CPU clocks                                                         match           !match
                             LAB_000012fc                                    
        000012fc 20 39 00        move.l     (DAT_00ffd02c).l,D0
                 ff d0 2c
        00001302 54 80           addq.l     #0x2,D0
        00001304 2d 40 ff f8     move.l     D0,(-0x8,A6)
        00001308 78 01           moveq      #0x1,D4
        0000130a 74 06           moveq      #0x6,D2
                             LAB_0000130c                                    
        0000130c 20 6e ff f8     movea.l    (-0x8,A6),A0
        00001310 52 ae ff f8     addq.l     #0x1,(-0x8,A6)
        00001314 10 10           move.b     (A0),D0b
        00001316 20 6e ff fc     movea.l    (-0x4,A6),A0
        0000131a 52 ae ff fc     addq.l     #0x1,(-0x4,A6)
        0000131e b0 10           cmp.b      (A0),D0b
        00001320 67 02           beq.b      LAB_00001324            ;;  10              8
        00001322 42 44           clr.w      D4w                     ;;  -               4
                             LAB_00001324                                    
        00001324 53 42           subq.w     #0x1,D2w
        00001326 4a 42           tst.w      D2w
        00001328 66 e2           bne.b      LAB_0000130c
        0000132a 4a 44           tst.w      D4w
        0000132c 66 0a           bne.b      LAB_00001338
        0000132e 33 fc 00        move.w     #0x1,(DAT_00ffd050).l
                 01 00 ff 
                 d0 50
        00001336 60 06           bra.b      LAB_0000133e
                             LAB_00001338                                    
        00001338 42 79 00        clr.w      (DAT_00ffd050).l
                 ff d0 50
                             LAB_0000133e                                    

[RickHaleParker]

What happens if you try to detect B6 first?