Vida CEM swapping

[dikidera]

Thank you prometey I will use it. Yesterday I did a small drive and did a manual dump of the F0 control variable, when the car upshifts, the values cycle betwen 0x0(or maybe 0x100) between 0x101, 0x102, 0x103. Interestingly, in 5th gear, the value is 0x104. When downshifting, the values become 0x20A, 0x209 etc. It seems that bit 10 signifies a downshift. Basically only when a shift request or shifting is in process, the F0 control variable contains a value, when the car has finished shifting, the value becomes 0.

However, there are 5 gears, but the value ranges are much more than the gears themselves. For instance, if the value of F0 is 0x104 when shifting 4-5, in the programming there is also sometimes the value 0x105 and 0x10C and 0x10D. I will have to see under what condition while driving I get these values.

I am almost done with my logger. The A7 TCM command returns a CAN frame of 3 bytes which I think is very very odd. I had to rewrite some of my code CAN frame class to work with the TCM can frame since there are differences between ECM and TCM can frame, very few. And then make it work with frames + standard A5 command mixed. And also modify my code because the way my code works, TCM CAN commands are not always FIFO and sometimes certain params get ignored for too long.

Addendum: So far my logs indicate that

F0,gbr <- contains logic selected gear for shifting , 0x101 being 2nd gear. and the. All 0x100 values are upshift, all 0x200 are downshift.
F2,gbr <- same value as F0, but there may be circumstances where this is not true
E2,gbr
E4,gbr <- contains the next gear as a word with real value e.g 3 for 3rd gear etc. However once the car is in 5th gear, the value becomes 7
E6,gbr <- same as E4 and E8 but slower to update.
E8,gbr <-same as E4.
35,gbr <- contains the progress or step of the shiting process, e.g from preparing torque limit request to currents and activations of the solenoids. 0xA is start of shifting process, 0x63 is end or Complete and there are several values in-between the shift process.

Are all control variables for the state of the shifting. While F0 and F2 contain the same value, it is not clear when they differ. E4, E6 and E8 are all the same, but there must be a purpose for them.

Interestingly, I am seeing that the gearbox is really limiting torque during shifting between 1-2-3. It is not consistent with what I saw in the ECM logs from before. I am seeing an upshift or downshift torque request much lower, e.g 50nm or 100 not the 150 I know of. Maybe this explains the horrendous shifting at times.

Addendum:
I have received my Mongoose JLR, I have verified it works with VIDA, and supposedly works with VDASH. I can now write Windows applications to interface with Volvo without needing RPI, that will be available to all that have any J2534 unit.
Because of Mongoose dongle, I have seen that VIDA had the ability to read both TPS sensors of Magnetti ETM, through the use of RAM addresses. This is very new to me and very nice, I can now better analyze my ETM(both dumps and general behavior).

[Alekseybv]

Hello. I read the entire thread. I can’t download the tools created by my friend T5Luke anywhere. Can someone share?

[Alekseybv]

What if to get sbl, listen to can with a sniffer while vdash changes the configuration?

[prometey1982]

What if to get sbl, listen to can with a sniffer while vdash changes the configuration?

Привет. Пиши по-русски. А так да, можно снифить КАН шину в момент смены конфигурации. А еще, можно и другие загрузчики заснифить так же. Я SBL блока Denso ECM от P3 снифил.

[dikidera]

I also have vdash and mongoose and plan to do the same.

Anyway, back to the gearbox adaptations. They do have an effect, but only at startup and the first few shifts. If I continually modify the RAM values of these adaptations, I no longer feel any difference as compared to my initial experiment. Perhaps it was placebo. But if I modify the adaptations to all zero, so no adaptation essentially, stop the car so they are written to EEPROM and start the car again, the shifts are very smooth for just 10-15 seconds or so.

I would say, the shifts were fast, I could not detect 1-2 shift, very slight bump on 2-3 and if I had accelerated very fast, the shift went directly to 5th gear so 3-5, and if there was 3-4 and then 4-5, I could not feel it. But this was only for 10 or 15 seconds.

Now, either the RAM values are less effective after they are read and used OR I suffer from a partially clogged filter that sucks up the gunk that has settled when the engine was off.

[Doclowe]

Hi can any one help me, I’ve got the eprom and flash data, but need the pin as having trouble adding a new key. Not sure how to upload data?

[al1Volvo]

Hi, I have made my own SBL in C for the P1 CEM ref 31327215, it is working well, I'm able to read the complete flash including eeprom, erase sectors and write to it. I tried it on an other CEM (still P1) 30765015 but it seems that asking the checksum using the CAN protocol doesn't work, on the 31327215 I have to send the frame B4 command and I get back the checksum but the 30765015 isn't answering, does anyone here have and can share this information please ?

I can probably find it using a OSBDM and debugging the CEM but it will take a lot of time...

Later when everything will be working well and the code will be cleaned up, I'll share the source code for both (SBL and uploader too, running on Linux) on github. For now a lot of works still need to be done.

[dikidera]

@a1Volvo, that is fantastic news.

I wished to give an update on my manipulations of the adaptations of the TCM. The biggest hurdle is understanding whether I am affecting Shift Pressure(SLS) or Line Pressure(SLT) adaptations. I think I am affecting SLS but not sure exactly. Anyway, the benefit I had of my original adaptations is no longer there in my opinion, though there is an improvement when going from 3-4 with my own adaptations than there is with how the gearbox re-adapts by itself. What I have noticed is that with a lower Line Pressure(controlled with throttle), the shifts are a bit smoother.

However I have not recently done a dump of my EEPROM to see what has further changed.

My other goal is to test a method I came up with to attempt to free up sticky solenoids. This may potentially cause damage or death of the solenoid. The goal is to, with a non-started car use diagnostic commands to essentially modulate the SLT and SLS currents rapidly causing the piston(called a pintle by Sonnax) inside to oscillate back and forth potentially causing the debris that make it stick to let go a bit. Then I would start the car, move through the gear shifter so that fluid can move through this solenoid and potentially clear it out. Stop the car and do the procedure again.
There is no scientific backing of my idea, the solenoid is an electromagnet so once it is energized, metallic debris will stick to it like glue. Temperature changes also cause the metals to expand which is why probably at higher temps my shifts are a bit worse. So I will attempt this procedure not only with ambient temp fluid but also working temp 85-100c.

Now since CAN is slow, I cannot effectively do this test quickly, I wanted very very high speeds of the solenoids, however CAN is slow giving me say an 8ms delay between each start and stop command. Tapping the electrical circuit from the TCM breakout box will yield better frequency, at the expense of more complexity as I would have to use something like an Arduino with relays to control the current. This adds complexity to a method which has no scientific backing to it.

Addendum:
I first tried this with key in pos II. I heard no clicking, but I assumed it works. Then I started the car and cycled through all the gears. Shut it off and do the experiment again for all three solenoids. Then afterwards I did the experiment with a started car in P position, now, since it is an experiment, I assumed responsibility. I heard what I assumed but couldn't be certain, pump whine. After which I shut off the car and started again. It appears when you modify ram values and shut off the car, the RAM is not powered off immediately as such the values are still there upon starting. It is only when you cycle from P to D do the RAM values change.

Was there an affect? I can't be certain. It might've been bad at worst, it might've achieved nothing at best. However I have not tested it on a longer drive, which I will do today, so any effects, both good or bad will become apparent.

[xiaofei204716]

If you have a need to check your PIN, you can ask me

[Nikolein]

Hello,

I tried to decode the CEM (30728542) of my 2005 Volvo S60 I. The decoding process seemed to work, but d5t5 says that the code is incorrect.
The VIN number is YV1RS654952461493.
Could someone please check the code?

Best regards,

Niko de Vries