Vida CEM swapping

[vtl]

Once again - 256 chip on the bottom of the picture above is 8MHz chip and it serves HS CAN. The one on the top, in this case - 128, is for LS CAN. In some cases (depends on CEM HW PN) chip on the top is 256, as well as both chips could be 384kB chips (for example with HW PN 31268178)

So, the right chip is on CAN-HS then, like expected, and yet something steps in between the cracker and the CEM's pin compare routing. The routine is very crackable: the shortest command executes 4 cycles at 8 MHZ, which translates to 1/4 CAN cycle.

[RickHaleParker]

Rick, I do not see 10k resistors on the board. I missed something or you missed it? Which transceivers are going to put in? Do they not need resistors?

NPX TJA1051T/3/1J which are Monolithic transceivers. Everything you need is contained within the SOIC8 package unless you need termination or power supply filtering. Don't need termination because the CEM diagnostic port is not a end node. Don't need power supply filtering because the PC's USB port takes care of that. Do you concur?

[ZRimaZ]

OK, clear! I probably missed that you are going to use TJA1051T.

[RickHaleParker]

OK, clear! I probably missed that you are going to use TJA1051T.

I'm still trying to sort out all the options. I like the current design because the leads are short. Minimum lead length, Minimum propagation delay. That could mean something in a timing attack. A female header and 90.° J1962, would have longer lead lengths more inductance, more propagation delay. Might effect the performance of the timing attack. What do you think?

[ZRimaZ]

OK, clear! I probably missed that you are going to use TJA1051T.

I'm still trying to sort out all the options. I like the current design because the leads are short. Minimum lead length, Minimum propagation delay. That could mean something in a timing attack. A female header and 90.° J1962, would have longer lead lengths more inductance, more propagation delay. Might effect the performance of the timing attack. What do you think?

I like your way of thinking. But, have you tried to test those transcievers even on breadboard? Because now you are putting all your power and time to make new design and the result could be negative in case if craxker will not work correctly for some reasons...

[RickHaleParker]

I like your way of thinking. But, have you tried to test those transcievers even on breadboard? Because now you are putting all your power and time to make new design and the result could be negative in case if craxker will not work correctly for some reasons...

Sharp is using TJA1051T/3 so we know they work. I am going to order one and check the performance against my breadboarded Bosch CF160 build.

The parallelogram pads on the ends are for a Folded J1962 male. That will eliminate the need for a OBD cable between the cracker and the OBD port. Less inductance.

The end of the board inserts into a Folded J1962. That was extra Real Estate so I added hole pads so it can be used with a wired OBD cable. Options for anybody that does not want to go the Folded J1962 route. One might want to put the PCB into a dedicated bench test fixture.

[Sh4rp]

Here are the Dumps from my 08690720 Bench CEM.

[Sh4rp]

Here are the Dumps from my 08690720 Bench CEM.

[Sh4rp]

Here are the Dumps from my 08690720 Bench CEM.

[Sh4rp]

Here are the Dumps from my 08690720 Bench CEM.