Vida CEM swapping

crasbe · Post by **crasbe** » 08 Dec 2022, 03:46

dikidera wrote: ↑06 Dec 2022, 16:55 A little fun fact is that Volvo were not fully experienced with Denso? Their watchdog function was called manually and interspersed in the whole code, rather than using a timer interrupt. Well, whatever, these are events from 15+ years ago, the world was a different place back then and Denso was used only a few years.

That is actually the point behind a Watchdog. If the code somehow stops execution, the Watchdog will trigger a reset and bring the system back from a crash.
If you reset the watchdog with a timer it's possible that only the timer is still running whereas the actual code has crashed. Therefore you place the watchdog reset commands all over the code to ensure it's still executing

dikidera · Post by **dikidera** » 09 Dec 2022, 02:59

So the final conclusion is that the original SBL can write to external memory devices. I would like to point out, that neither the SBL nor the ROM use the unlock commands to unlock the external flash. I can also assume that by enabling flashing of the main ROM, flashing of external devices is also enabled, but also unlock commands are automatically sent as well, but this was not mentioned in the hardware manual. I couldn't have known.

The external flash chips need special commands to enable writing of data, by sending 0x555 and 0x2AA masks in several cycles. Since none of these byte patterns appear in any ROM or SBL, only the internal circuitry of the 7055 chip would be able to generate them.

prometey1982 · Post by **prometey1982** » 09 Dec 2022, 08:55

dikidera wrote: ↑09 Dec 2022, 02:59 So the final conclusion is that the original SBL can write to external memory devices.

Does this SBL can flash TF80SC TCU module? Or is it only for ECM?

dikidera · Post by **dikidera** » 09 Dec 2022, 11:37

I do not know. I do not have a TF80.

oscilloscope · Post by **oscilloscope** » 10 Dec 2022, 17:46

Folks I have a cem L here I'm working through. The customer had some work done on it. Some keys where added but it corrupted the eeprom. The request is to clone and sort the synchro out & add some keys (correctly) , I was given another cem L same part number & the cem eeprom works no issue. But i can't check if the eeprom has the vin within or if its just in the flash. , but the orginal cem L's eeprom is none recoverable, does the eeprom have the vin within? Or is it only localised in the flash? If not then I can use the donor eeprom and then add the orginal keys to that and be rid of this job. 10 weeks and counting 6-7weeks waiting for customer to send the keys to me urgghhh!

oscilloscope · Post by **oscilloscope** » 10 Dec 2022, 18:04

oscilloscope wrote: ↑10 Dec 2022, 17:46 Folks I have a cem L here I'm working through. The customer had some work done on it. Some keys where added but it corrupted the eeprom. The request is to clone and sort the synchro out & add some keys (correctly) , I was given another cem L same part number & the cem eeprom works no issue. But i can't check if the eeprom has the vin within or if its just in the flash. , but the orginal cem L's eeprom is none recoverable, does the eeprom have the vin within? Or is it only localised in the flash? If not then I can use the donor eeprom and then add the orginal keys to that and be rid of this job. 10 weeks and counting 6-7weeks waiting for customer to send the keys to me urgghhh!

Never mind I found the vin. , is there a checksum involved if I where to edit it to the correct vin ?

dikidera · Post by **dikidera** » 12 Dec 2022, 10:48

It was time to test out my frankenstein setup. I went to my S60, I plugged in my OBD cable and could see the CAN bus working fine, but then I sent one command to the car, 0xFF86000000000000, and the car restarts...any ideas why this happens?

prometey1982 · Post by **prometey1982** » 12 Dec 2022, 10:59

Here is CEM parameters from DHA

oscilloscope · Post by **oscilloscope** » 12 Dec 2022, 14:18

dikidera wrote: ↑12 Dec 2022, 10:48 It was time to test out my frankenstein setup. I went to my S60, I plugged in my OBD cable and could see the CAN bus working fine, but then I sent one command to the car, 0xFF86000000000000, and the car restarts...any ideas why this happens?

what does that equate too that command code?

dikidera · Post by **dikidera** » 12 Dec 2022, 14:22

oscilloscope wrote: ↑12 Dec 2022, 14:18
dikidera wrote: ↑12 Dec 2022, 10:48 It was time to test out my frankenstein setup. I went to my S60, I plugged in my OBD cable and could see the CAN bus working fine, but then I sent one command to the car, 0xFF86000000000000, and the car restarts...any ideas why this happens?
what does that equate too that command code?

It depends. I use socketCAN and a can utility called cansend and do 000FFFFE#FF86000000000000 and the linux socket can driver takes care of communication via MCP2515

Ah you mean what the command does? It tells all the controllers(ECU,TCM,AEM whatever) to stop sending can commands and enter programming mode.

Vida CEM swapping

Re: Vida CEM swapping