Login Register

Vida CEM swapping

A mid-size luxury crossover SUV, the Volvo XC90 made its debut in 2002 at the Detroit Motor Show. Recognized for its safety, practicality, and comfort, the XC90 is a popular vehicle around the world. The XC90 proved to be very popular, and very good for Volvo's sales numbers, since its introduction in model year 2003 (North America). P2 platform.
Post Reply
User avatar
RickHaleParker
Posts: 7129
Joined: 25 May 2015
Year and Model: See Signature below.
Location: Kansas
Has thanked: 8 times
Been thanked: 958 times

Re: Vida CEM swapping

Post by RickHaleParker »

eltoro wrote: 20 Jan 2022, 02:21

I am not an expert here not even beginner, but somehow that does not sound right.

I liked a lot their open source solution, have you seen that?

https://oshwlab.com/search?wd=teensy%20can


Where people can publish their schematics, board designs BOM's etc. (with various licenses). One can pickup some project as base and continue there or order boards etc.
Something else funny. If I use a part that is in the JLCPCB assembly library and I click to get the datasheet it takes me to the LCSC website not the JLCPCB website. EasyEDA, JLCPCB, LCSC and OSHLab maybe separate companies but it looks like they are all owned by the same investment group. It looks like the wanky stuff is the MBAs bickering among themselves. Instead of cooperating and making some something great that would sell like hot cakes. Only idiots would let their bickering bleed through to the customer. Don't get me wrong, it looks like they have good software engineers and employees but the way the companies are being managed is idiotic.

I have not looked at OSHWLab before. I did find a Teensy Can shield in there based on the Texas Instruments SN65HVD232DR. It looks like it would with the CEM Cracker. Some of the parts are are out of stock or discontinued but they are non-critical parts the CEM Cracker does not need. No one click to get a JCLPCB assembly.

The Texas Instruments SN65HVD232DR is an older chip. I hoping to do something more up to date. Newer chips have better performance like noise rejection. The NXP chips I am working with at have an internal Logic level converter. You can run the MCU I/O at 3.2 V and the CAN at 5V. I been using 5V Bosch CF160 on the Teensy 4.0 and getting away with it. Some people are weary about that. Me I know that often the voltage limit is RMS not Peak voltage. Datasheet do not tell you either way. The RMS of a 5V CAN Bus signal is going to be lower the 3.2V RMS. The I/O won't over heat.
⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000.
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0.

Sh4rp
Posts: 28
Joined: 3 January 2022
Year and Model: See below.
Location: Braunschweig
Has thanked: 2 times
Been thanked: 1 time

Post by Sh4rp »

Anybody has a Pin Layout for the P1 CEM to crack it on the bench?
2004 - V50 T5 AWD M66 - Flint Grey
1996 - 850 T-5R M56 - Dark Olive Pearl

User avatar
RickHaleParker
Posts: 7129
Joined: 25 May 2015
Year and Model: See Signature below.
Location: Kansas
Has thanked: 8 times
Been thanked: 958 times

Post by RickHaleParker »

Sh4rp wrote: 23 Jan 2022, 10:56 Anybody has a Pin Layout for the P1 CEM to crack it on the bench?
Go to page 145. There are instructions on where to find it in VIDA.
⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000.
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0.

User avatar
RickHaleParker
Posts: 7129
Joined: 25 May 2015
Year and Model: See Signature below.
Location: Kansas
Has thanked: 8 times
Been thanked: 958 times

Post by RickHaleParker »

Sh4rp wrote: 16 Jan 2022, 02:15 Maybe we could swap the solder connection to a female pin header so we can just plug it onto the can shield? Gives the teensy a second life if the cracker is not used.
I will include Female header in the BOM but don't include them in the PCB board build if you want install the cracker in the case. Space problems: You would be able to get the shield and Teensy in the case without a USB cable. Without a USB cable it would be useless. Unless you can find a USB cable with a plug no more then 3mm thick. The metal part of a USB Micro B is 2 mm thick.

The idea of connecting the USB cable to the Shield is pretty much a dead end because of the 2.29 mm spacing between the D+ & D- pads on the bottom of the Teensy. I cannot find any Pogo Pins with a base smaller then 2.0mm. 2.29mm - 2.0mm leaves just 0.29mm between the Pogo pins. 0.29mm is not enough space for angular rings and solder mask.

Still working on the design.
⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙⸙
1998 C70, B5234T3, 16T, AW50-42, Bosch Motronic 4.4, Special Edition package.
2003 S40, B4204T3, 14T twin scroll AW55-50/51SN, Siemens EMS 2000.
2004 S60R, B8444S TF80 AWD. Yamaha V8 conversion
2005 XC90 T6 Executive, B6294T, 4T65 AWD, Bosch Motronic 7.0.

AA2020
Posts: 8
Joined: 3 April 2021
Year and Model: 2007/ V50
Location: Riga

Post by AA2020 »

P1 CEM Never cracked
PIN: 15 82 06 59 81 62

Serial No 000000240383
Hardware number 0008690720
Diagnostic number 31264678 AA
Software number 0030786197 AA
Software number 0031343123 AA
Software number 0031254048 AA
Attachments
CEM_08690720_31264678_30786197_31343123_31254048_2005_S40.rar
(580.69 KiB) Downloaded 140 times

vtl
Posts: 4724
Joined: 16 August 2012
Year and Model: 2005 XC70
Location: Boston
Has thanked: 114 times
Been thanked: 605 times

Post by vtl »

AA2020 wrote: 27 Jan 2022, 02:39 P1 CEM Never cracked
PIN: 15 82 06 59 81 62

Serial No 000000240383
Hardware number 0008690720
Diagnostic number 31264678 AA
Software number 0030786197 AA
Software number 0031343123 AA
Software number 0031254048 AA
Thanks, your CEM dumps really helped. This is the pin routine found in the dump for MC9S12DT256_1K79X:

Code: Select all

.data:0003fe38 34                               pshx
.data:0003fe39 35                               pshy
.data:0003fe3a b7 46                            tfr  D,Y
.data:0003fe3c ce fe f8                         ldx  #0x0000fef8
.data:0003fe3f a6 70                            ldaa 1,Y+
.data:0003fe41 a1 05                            cmpa 0x5,X
.data:0003fe43 26 1e                            bne  0x0x0003fe63
.data:0003fe45 a6 70                            ldaa 1,Y+
.data:0003fe47 a1 02                            cmpa 0x2,X
.data:0003fe49 26 18                            bne  0x0x0003fe63
.data:0003fe4b a6 70                            ldaa 1,Y+
.data:0003fe4d a1 01                            cmpa 0x1,X
.data:0003fe4f 26 12                            bne  0x0x0003fe63
.data:0003fe51 a6 70                            ldaa 1,Y+
.data:0003fe53 a1 04                            cmpa 0x4,X
.data:0003fe55 26 0c                            bne  0x0x0003fe63
.data:0003fe57 a6 70                            ldaa 1,Y+
.data:0003fe59 a1 00                            cmpa 0x0,X
.data:0003fe5b 26 06                            bne  0x0x0003fe63
.data:0003fe5d a6 40                            ldaa 0x0,Y
.data:0003fe5f a1 03                            cmpa 0x3,X
.data:0003fe61 27 04                            beq  0x0x0003fe67
.data:0003fe63 c6 00                            ldab #0x0
.data:0003fe65 20 02                            bra  0x0x0003fe69
.data:0003fe67 c6 01                            ldab #0x1
.data:0003fe69 31                               puly
.data:0003fe6a 30                               pulx
.data:0003fe6b 3d                               rts
The order is 5, 2, 1, 4, 0, 3. Could you try it with shuffle order set to 2?

Code: Select all

diff --git a/volvo-cem-cracker.ino b/volvo-cem-cracker.ino
index 9016d54..b37845e 100644
--- a/volvo-cem-cracker.ino
+++ b/volvo-cem-cracker.ino
@@ -68,7 +68,7 @@ struct _cem_params {
 } cem_params[] = {
 // P1
   { 8690719,  CAN_500KBPS, 0 },
-  { 8690720,  CAN_500KBPS, 0 },
+  { 8690720,  CAN_500KBPS, 2 },
   { 8690721,  CAN_500KBPS, 0 },
   { 8690722,  CAN_500KBPS, 0 },
   { 30765471, CAN_500KBPS, 0 },
Rick had this change in his commit that regressed newer P1 CEMs and has been reverted. We probably need to revive his commit after confirming shuffle orders on real hardware.

Sh4rp
Posts: 28
Joined: 3 January 2022
Year and Model: See below.
Location: Braunschweig
Has thanked: 2 times
Been thanked: 1 time

Post by Sh4rp »

Didnt work for me
Attachments
4.txt
(122.74 KiB) Downloaded 101 times
5.txt
(122.79 KiB) Downloaded 91 times
2004 - V50 T5 AWD M66 - Flint Grey
1996 - 850 T-5R M56 - Dark Olive Pearl

vtl
Posts: 4724
Joined: 16 August 2012
Year and Model: 2005 XC70
Location: Boston
Has thanked: 114 times
Been thanked: 605 times

Post by vtl »

Anyone knows which side MC9S12DT256 is, HS or LS?

ZRimaZ
Posts: 77
Joined: 8 March 2009
Year and Model: XC60 MY2016 3.0 T6
Location: Lithuania, Kaunas
Has thanked: 23 times
Been thanked: 13 times

Post by ZRimaZ »

vtl wrote: 27 Jan 2022, 09:09 Anyone knows which side MC9S12DT256 is, HS or LS?
HS is the right one, with 8MHz resonator
Have a nice day,

ZRimaZ

vtl
Posts: 4724
Joined: 16 August 2012
Year and Model: 2005 XC70
Location: Boston
Has thanked: 114 times
Been thanked: 605 times

Post by vtl »

ZRimaZ wrote: 27 Jan 2022, 09:11 HS is the right one, with 8MHz resonator
So, what chip is on the right side, with 128k or 256k flash? :)

Post Reply
  • Similar Topics
    Replies
    Views
    Last post