Vida CEM swapping

[V70user]

I have read a PIN from flash memory of CEM-B , and save it as a cem.bin file.
Open a T5Luke's CEMtool , upload cem.bin file to this program , PIN code shows in the textbox , i Choose one of the
car config item and try to send it to CEM, but Dice connects and in a moment I get an answer: Wrong Code...
PIN was read from unsoldered flash memory so it is correct.
I tried changing the order of the numbers in the PIN, but to no avail. Still Wrong Code
Any idea?
Is there a possibillity that CEMTool doesn't work correctly?

Correction: HW P/N : 86 88 434 (CEM on the bench) brickshape CEM
I have tried all 720 possibilities of order of PIN numbers - CEMTool still answers: wrong code.
My friend has written into CEM a new PIN : 01 01 01 01 01 01 , CEM Tool answers: wrong code...
wtf? With this new PIN order of numbers doesn't matter, so what is wrong?
I don't have a clue how to bite this. DiCE connects, sends a request with PIN numbers and that's it.
Has anyone such an expierence with T5Luke's CEM tool , that program doesn't work?
Or can anybody help me resolve it? Or how can I contact with T5Luke?
Thank You for any help...

[xanthefin]

I have read a PIN from flash memory of CEM-B , and save it as a cem.bin file.
Open a T5Luke's CEMtool , upload cem.bin file to this program , PIN code shows in the textbox , i Choose one of the
car config item and try to send it to CEM, but Dice connects and in a moment I get an answer: Wrong Code...
PIN was read from unsoldered flash memory so it is correct.
I tried changing the order of the numbers in the PIN, but to no avail. Still Wrong Code
Any idea?
Is there a possibillity that CEMTool doesn't work correctly?

Correction: HW P/N : 86 88 434 (CEM on the bench) brickshape CEM
I have tried all 720 possibilities of order of PIN numbers - CEMTool still answers: wrong code.
My friend has written into CEM a new PIN : 01 01 01 01 01 01 , CEM Tool answers: wrong code...
wtf? With this new PIN order of numbers doesn't matter, so what is wrong?
I don't have a clue how to bite this. DiCE connects, sends a request with PIN numbers and that's it.
Has anyone such an expierence with T5Luke's CEM tool , that program doesn't work?
Or can anybody help me resolve it? Or how can I contact with T5Luke?
Thank You for any help...

Its not for Brick CEMs that tool directly if you look more closer it if i remember right when i tested it.

[V70user]

This works on all CEMs to MY 2004, 10th place of VIN Y, 1, 2, 3 or 4. Read cem by arduino once, place it back into car and change how often you like by dice.

This above is what Luke said...so my V70 (Y in VIN - year 2000, MY2001 ) should be ok to use CEMTool

[xanthefin]

Oh i see i was talking of the wrong tool of T5Luke and not this one. UDS tools i had in my mind and those didn't work on me at all due how they talked when i checked why. Specially on 32bit windows with bug with PIN code message.

[dikidera]

If anyone open a TCM binary, the few TCM strings stand out. These should be configurations flags for the transmission. I have deduced a few with no confirmation of course.

USE_HWB4 - B4 servo related or Valve body modification related.
USE_P2X - obviously code base for P2 series.
USE_AW - not sure.
NOT_TIP - Fairly obvious for my BIFUEL. It's inclusion in the configuration states we do not have Tiptronic and it is also firmware disabled by omission of relevant code. Aka #ifdef USE_TIP/ #ifndef USE_TIP.
USE_BK_STROKE - Tricky, but perhaps it means Brake stroke or if you press the brakes on a downhill or when coasting, the car disengages all gear. Similar to neutral control. This is what I have on my car.
USE_AIRCON_STATUS - This is perhaps self-explanatory or at least hinting to behavior.
USE_SH7055 - Obvious.
USE_SHIFT_TRQ_LIM - Configured with torque limit during shifting.
USE_NEW_TRQ_RED - Perhaps indication of a Torque reduction algorithm.
USE_E_THROTTLE - Aka drive by wire.
NOT_SIM - Unknown.
USE_ETH_TRQ_LIM - Enabled on bifuel models. Possibly indicating that the ECM is configured to reduce throttle(and ignition timing) for torque reduction during shifting.
USE_ULEV_BKST - ULEV = Ultra Low Emission Vehicle, BK could be Braking.
USE_SLIPFAIL - Slip fail algorithm? Limp mode?
USE_NFAIL - Neutral Fail?
USE_SHUDDER_DET - Self explanatory
NOT_ICE - Curious. Ice as in water ice or Internal Combustion Engine? The second is unlikely.
NOT_VAT2000 - Some configuration software for Volvo Engines.
NOT_DIA_PREPROD
NOT_PASSIVE
NOT_NODIAGNOS
NOT_NOWNT_P80 - No winter mode?
P24 24ULEV 140 hp - my tcm/engine designation.

I wonder if there were any volvos with NA engines(Only S60/V70 p2) that had the tiptronic enabled. According to some brochures I found, all NA engines came without the manual mode for shifting. Which means only the turbo models with Bosch ECU got them. Maybe if there is a similar CAN configuration matrix across Denso/Bosch engines, a 2.4t TCM might enable this feature for some. But so far it seems unlikely.

[oscilloscope]

The CEM is on bench test, it will never be connected to a car, I only make some research on it using debugger.
The files will only serve to make it work normally again !

20240524_150200.jpg

By the what do you mean by "your car is dead" ? Other ECU will do into a locking mode ?

do you have the pin out for the key reader too the cem ?

[al1Volvo]

On the reader :

Pin | Function | CEM connector | PIN
1 | GND | Any ground pin |
2 | LIN BUS | Cockpit-2 | 17
3 | POWER | Any Power In on the bench (Normally powered from the key barrel 6

Do you need also the pinout for the 7 Pin connector form the barrel ?

[oscilloscope]

On the reader :

Pin | Function | CEM connector | PIN
1 | GND | Any ground pin |
2 | LIN BUS | Cockpit-2 | 17
3 | POWER | Any Power In on the bench (Normally powered from the key barrel 6

Do you need also the pinout for the 7 Pin connector form the barrel ?

I'm not sure I follow fully here so is that the green connector your referring too for cockpit-2? And its pin 17 for that connector?

And Yes please the pinout for the barrel would be extremely handy.

[dikidera]

Continuing my TCM reverse engineering I stumbled upon a constant that seemed related to gear ratios.

It is calculated like so: (((37699 * 314) / 2440) * 4096) / 10000 = const
The reason for the integer multiplication is for errorrless multiplication. So 37699 could be 3769.9 or 3.7699. 314 could be something Pi related it is wheel mm, thanks to a certain screenshot I glimpsed . 2440 is most definitely the final drive of AW55.
Fun fact, many many years ago there was a guy that started a Bitcoin exchange that used floating point math for money, which was a big no no. The exchange was drained of Bitcoins due to rounding errors. I smelled trouble a bit before the issue and got my money out. But this was 10+ years ago, maybe even 12. But I digress.

The resultant value of const was 1987 or 1986 on my Windows calculators. I was very puzzled until I went online on a tyre circumference calculator



We can then deduce this must be the Tyre circumference especially since it is integral for the Speed in Kmh calculation. The value is slightly higher, but likely not an issue.

The name of this variable did not exist in DHA, thus it was my own work that deduced it. And it is a very integral variable to know. Changing any one parameter of a tyre changes the internal calculations. Being able to modify it based on a user's actual tyre circumference(17 inch or 15 inch) is nice a thing.

Anyway, the reason I went to figure out this variable was because it seems to be somewhat related to Shift Diagrams. My flow process is to find any variables that can ease my understanding of the control flow.

[Alliottom59]

Hello

I have just programmed the teensy, now how do I start reading the pin?

Thanks