Vida CEM swapping

[Alliottom59]

I just succeeded

Thanks

[al1Volvo]

On the reader :

Pin | Function | CEM connector | PIN
1 | GND | Any ground pin |
2 | LIN BUS | Cockpit-2 | 17
3 | POWER | Any Power In on the bench (Normally powered from the key barrel 6

Do you need also the pinout for the 7 Pin connector form the barrel ?

I'm not sure I follow fully here so is that the green connector your referring too for cockpit-2? And its pin 17 for that connector?

And Yes please the pinout for the barrel would be extremely handy.

Sorry for the delay, I wasn't at home.
Do you have the P1 CEM ? If yes, everything is written on the box (Connector name, Pin numbering).

About the barrel pinout :
On barrel connector :
PIN No | CEM PIN No
1 | 30 on Cockpit-1
2 | 42 on Cockpit-1
3 | 17 on Cockpit-1
4 NC
5 | 40,15 on Cockpit-1
6 | Power out for Key reader (see previous post)
7 | 23, 22, 21, 20 on Front-1

If you have any doubt, double check on EWD https://volvodiag.com/ewd-online-fra/

[dikidera]

Today is the first time I've been stumped. I found some interesting code in the TCM that has something to do with oil temperature and pressures, like an averaging function or something like that. Unfortunately it seems to only ever read from a particular memory region, but I cannot find a single relative or otherwise store in that memory region. And it is a huge region.

Perhaps it's calculating the change of oil pressure based on the avg oil temp or the avg oil pressure based on oil temp. But from my point of view, these memory regions are not being written to, only ever read...and I doubt they would be 0 all the time. Or maybe it's creating a lookup table of pressures and temperatures for faster calculation. Without the initial data, I cannot be certain.

No gbr offset access, no relative index + memory_address, nothing. The only other function that can modify these tables is the EEPROM_write and read functions, since they take a pointer to a buffer to read from or write to, but even those did not yield the results I expected.

I may have to actually read these memory tables in-vehicle while it's running to get a sense of whether they contain data or are always zero.

[oscilloscope]

On the reader :

Pin | Function | CEM connector | PIN
1 | GND | Any ground pin |
2 | LIN BUS | Cockpit-2 | 17
3 | POWER | Any Power In on the bench (Normally powered from the key barrel 6

Do you need also the pinout for the 7 Pin connector form the barrel ?

I'm not sure I follow fully here so is that the green connector your referring too for cockpit-2? And its pin 17 for that connector?

And Yes please the pinout for the barrel would be extremely handy.

Sorry for the delay, I wasn't at home.
Do you have the P1 CEM ? If yes, everything is written on the box (Connector name, Pin numbering).

About the barrel pinout :
On barrel connector :
PIN No | CEM PIN No
1 | 30 on Cockpit-1
2 | 42 on Cockpit-1
3 | 17 on Cockpit-1
4 NC
5 | 40,15 on Cockpit-1
6 | Power out for Key reader (see previous post)
7 | 23, 22, 21, 20 on Front-1

If you have any doubt, double check on EWD https://volvodiag.com/ewd-online-fra/


20240607_230114.jpg
20240607_230341.jpg
20240607_230441.jpg

O my goodness, I have never noticed that the connectors have connector ID's I have 5 of these in my workshop currently !!

[al1Volvo]

[al1Volvo]

The CEM is on bench test, it will never be connected to a car, I only make some research on it using debugger.
The files will only serve to make it work normally again !

20240524_150200.jpg

By the what do you mean by "your car is dead" ? Other ECU will do into a locking mode ?

for one you cant use the key anymore, if you physically put a other cem in a car that dont belongs to it nothing works

anyway here is file set

31327215 2x 384 mcu.rar

Have you edited the PIN code to set it up to 99 99 99 99 99 99 ?

[al1Volvo]

I'm not sure I follow fully here so is that the green connector your referring too for cockpit-2? And its pin 17 for that connector?

And Yes please the pinout for the barrel would be extremely handy.

Sorry for the delay, I wasn't at home.
Do you have the P1 CEM ? If yes, everything is written on the box (Connector name, Pin numbering).

About the barrel pinout :
On barrel connector :
PIN No | CEM PIN No
1 | 30 on Cockpit-1
2 | 42 on Cockpit-1
3 | 17 on Cockpit-1
4 NC
5 | 40,15 on Cockpit-1
6 | Power out for Key reader (see previous post)
7 | 23, 22, 21, 20 on Front-1

If you have any doubt, double check on EWD https://volvodiag.com/ewd-online-fra/


20240607_230114.jpg
20240607_230341.jpg
20240607_230441.jpg

O my goodness, I have never noticed that the connectors have connector ID's I have 5 of these in my workshop currently !!

And a last point, if you are looking for the original connector, you can easily pick them up on crashed Ford Focus (CMAX, fiesta and so) who are sharing the same CEM but with some differences in connector pinout (internal board) and software, just rearrange the pinout on the connector and go.

[gun4a17]

Maneged get flash with dice and "USDT" . Pin at 4e000 484172010746 .
Can some one chek please CEM is H 30786890
I found where is parametr in flash but how can i write back to cem using Dice . i dont have any other programmer . Car prog is on the way.
i tried lukes cemtool but it looks it dont work parameters are in dirent place.


Edit: CEM flash reader says wrong code.

Can i edit manualy cem parametrs and use cemtool to upload bin? does write addres matches or it will brick cem?

[dikidera]

I discovered it is possible to dump the EEPROM adaptations from the Temic TCM by using 6E A7.

Sadly the reverse is not possible or if it is, I have not seen the mechanism to directly write to EEPROM. A kernel to hook the EEPROM write functions can be written and may be possible to write to it.

Further in my analysis I have seen a few large adaptation tables. One is size 0x40, two are size 0x1E, and one 0xA.

These 4 tables are possibly the adaptation tables as specified by VIDA. For the 1-2, 2-3 4-5 etc and between P and D and D and N and so forth. I have not correlated which table is for what, but I do have their specific memory addresses. One is somehow related to oil temps.

Now, my plan is to attempt to modify these adaptation memory addresses(once I figure out which of these do what) and thus modify my adaptations whilst the car is running.

But of course I do not have the bigger picture yet, I am still figuring out more and more memory addresses and their relationship. For instance I did not find the TCC lock and unlock tables which I know are 6 rows in each table, and there are 7 tables. I will have to datalog my vehicle to find the exact speed at which the tc is locked(relative to pedal pos) and reverse search the value(which is a single byte for speed, thus the gearbox cannot handle speeds > 255kmh).

Furthermore since the SLU, SLT and SLS solenoids are all multi-purpose it is difficult to separate when one usage of a pressure of say the SLU solenoid is for just TCC or for a gear engagement.

[wxp73]

there are 7 tables

It's because the TCM has 7 different driving style programs.

use cemtool to upload bin

If you already found the correct PIN for your CEM, you can simply copy/paste it in this field and push the Program CEM button.