Vida CEM swapping

[dikidera]

My first experiment with the altered firmware was that the gearbox would engage first gear, but somehow the accelerator was ignored. I would slam the accelerator and something would immediately bring it down. As if something was inhibiting it.

Either there was something in EEPROM related to signal configuration or my changes to various torque reduction functions caused the TCM to constantly request torque to be inhibited even during idle.

With the changed firmware I used VIDA to read a few parameters and there was no reason for the accelerator to behave weirdly. I will revert all changes made and see if the original firmware on the new TCM again does this.

[dikidera]

Tomorrow I will test my TCM changes. In the meantime I have found this document which may help with figuring out some stuff. The below image is from TF-60SN but they mention the control logic is the same.



By also reading the patent document for the five speed more information can be extracted.

https://data.epo.org/publication-server ... cument.pdf

And very little but still useful information from a jstor paper accessible via https://sci-hub.se/10.4271/2001-01-0871

[dikidera]

Today I tested my modifications. I had changed what I believed were the TCC Slip lockup maps, however the car still turned on Slip lockup. It could be those maps were for Full lockup instead, however my daily drive to work in an urban environment does not allow me to reach usual full lockup speeds to see if it is indeed Full Lockup maps.

Curiously after these lock/slip lock speeds have been fetched from the maps and a few flags set, there is a piece of code which conditionally overwrites the previous step's flags e.g ignoring the maps. I have no idea why it was done like that.

With that in mind this only means that to get the results I want, I need to datalog the TCM further. But the TCM has limits in this regard, it processes RAM read commands on a work cycle, which means by the time my command is processed, I have no view of the state of the RAM addresses.

[dikidera]

I did further logging. I thought I had narrowed down the majority of the TCC slip/full lockup logic, and found two control variables which seemed to mostly determine if it should slip or lockup.

So I saw that one of the control variables was 0x20 when slipping and 0x04 when full lockup is engaged. However I noticed there was a particular moment where the control variable was 0x20 and it still locked up, with the only variable seeming different was the particular pedal position they use which was 0. Basically according to my logs, if I let go of the accelerator and basically engine brake and I was > the full lockup speed, the TCC would go from slipping lockup to full lockup with the 0x20 control variable which was usually attributed to just slip lockup. But inside the big function which I am analyzing there is no flag/memory address being set that would be read outside of the function itself. This may mean that after this function is another one which separately checks if we are engine braking perhaps and also checks if we are > lock speed threshold?

The TCM itself uses many copies of different signals and mutates them. My default accelerator position is something like 7% all the time, but the TCM uses several mutated copies. Sometimes the real pedal position, sometimes a mutated copy going from 0 to 150 where 0 is default pedal position.

[dikidera]

I think I got it, but will require another re-flash of the maps. I believe the lockup maps I found were specifically for slip lockup and do not affect full lockup. For each gear after 2nd gear there is a map that says when it should slip lockup and when it should disable it. What I have done is pretty much up the disable threshold for slipping lockup and did not disable slip lockup speeds which I mistakenly thought were full lockup, which means that once it entered the region where it isn't fully locked up, it would always slip lockup and never disable it unless I was accelerating or in kickdown mode.

Funnily enough while perusing the code I found a small bug. Someone had inadvertently left a double copy of a variable which the compiler did not omit.

e.g

variable1 = somevalue
variable1 = somevalue



though it does make me wonder if they intended a different variable to be zeroed out there

Further analysis

The algorithm is quite convoluted and at times make no sense. At first we determine slip lockup state based on speed in kmh from ABS, then we have another piece of code calculating lockup state based on if cruise control is active or not again, based on speed from ABS.

But then full lockup algorithm depends on if we have slip locking enabled(thresholds are normal values), if we never reach these thresholds, we will neither slip lock nor full lock. If we choose to slip lock, only then do we get to the code path that calculates our regular lock speed but it calculates them not from ABS vehicle speed, but from output shaft speed.
BUT

there is one single control byte which is set to 0x2(slip locking enabled) if we disable this control byte(set to 0) our slip lockup maps become the DE FACTO full lockup maps because it skips most of the code and directly sets our mode to full lockup(0x04) but then these lockup speeds are ABS dependent. This configuration change has not been tested it's just what my static analysis reveals and I have spent a whole week on this big function.



And then the output shaft speeds



But these appear to be thresholds, there is another code path which finally decides where we jump(0x04 lockup)

And just in case it isn't clear:

vehicle speed km/h = output shaft speed * tyre circumference (in meters) * 60 / final drive * 1000
which becomes
1600 * 1.986(constant in TCM or fetched from CEM; standard 205/55/r16 tyre) * 60 * 2440 = 78km/h

[nikemen]

Hello there!
I've got the printed board (https://www.pcbway.com/project/sharepro ... 037d5.html) to crack the CEM PIN of my C30 and I soldered the Teensy and the Bosch transceivers, but it doesn't work. I got no communication with the car's bus, regardless of the key position. Basically, I get the same respnse in the console whether the cable is connected to the car's OBD or not.
When I compare the plan posted on volvo-cem-cracker's Github to the board I got, I see my board hasn't any resistor. I get R3 and R4 are not needed when cracking via OBD, but the board has no place either for R1 and R2. I think that could be the source of the problem, but I am not sure.
Also, the Bosch CF160 transceivers don't have numbered pins or a dot to signal pin 1, so I could have soldered them wrongly... but nothing smoked while connecting them.
Can someone guide me in the right direction? Did someone make it work with the PCB I got?
Thanks in advance!

[vtl]

I think I got it, but will require another re-flash of the maps. I believe the lockup maps I found were specifically for slip lockup and do not affect full lockup. For each gear after 2nd gear there is a map that says when it should slip lockup and when it should disable it. What I have done is pretty much up the disable threshold for slipping lockup and did not disable slip lockup speeds which I mistakenly thought were full lockup, which means that once it entered the region where it isn't fully locked up, it would always slip lockup and never disable it unless I was accelerating or in kickdown mode.

Funnily enough while perusing the code I found a small bug. Someone had inadvertently left a double copy of a variable which the compiler did not omit.

e.g

variable1 = somevalue
variable1 = somevalue



though it does make me wonder if they intended a different variable to be zeroed out there

Further analysis

The algorithm is quite convoluted and at times make no sense. At first we determine slip lockup state based on speed in kmh from ABS, then we have another piece of code calculating lockup state based on if cruise control is active or not again, based on speed from ABS.

But then full lockup algorithm depends on if we have slip locking enabled(thresholds are normal values), if we never reach these thresholds, we will neither slip lock nor full lock. If we choose to slip lock, only then do we get to the code path that calculates our regular lock speed but it calculates them not from ABS vehicle speed, but from output shaft speed.
BUT

there is one single control byte which is set to 0x2(slip locking enabled) if we disable this control byte(set to 0) our slip lockup maps become the DE FACTO full lockup maps because it skips most of the code and directly sets our mode to full lockup(0x04) but then these lockup speeds are ABS dependent. This configuration change has not been tested it's just what my static analysis reveals and I have spent a whole week on this big function.



And then the output shaft speeds



But these appear to be thresholds, there is another code path which finally decides where we jump(0x04 lockup)

And just in case it isn't clear:

vehicle speed km/h = output shaft speed * tyre circumference (in meters) * 60 / final drive * 1000
which becomes
1600 * 1.986(constant in TCM or fetched from CEM; standard 205/55/r16 tyre) * 60 * 2440 = 78km/h

Can you disable the slip? Change final drive ratio? Say, I want to install an XC90 final drive. Set non standard tire size?

[vtl]

Hello there!
I've got the printed board (https://www.pcbway.com/project/sharepro ... 037d5.html) to crack the CEM PIN of my C30 and I soldered the Teensy and the Bosch transceivers, but it doesn't work. I got no communication with the car's bus, regardless of the key position. Basically, I get the same respnse in the console whether the cable is connected to the car's OBD or not.
When I compare the plan posted on volvo-cem-cracker's Github to the board I got, I see my board hasn't any resistor. I get R3 and R4 are not needed when cracking via OBD, but the board has no place either for R1 and R2. I think that could be the source of the problem, but I am not sure.
Also, the Bosch CF160 transceivers don't have numbered pins or a dot to signal pin 1, so I could have soldered them wrongly... but nothing smoked while connecting them.
Can someone guide me in the right direction? Did someone make it work with the PCB I got?
Thanks in advance!

Show pictures?

[dikidera]

I think I got it, but will require another re-flash of the maps. I believe the lockup maps I found were specifically for slip lockup and do not affect full lockup. For each gear after 2nd gear there is a map that says when it should slip lockup and when it should disable it. What I have done is pretty much up the disable threshold for slipping lockup and did not disable slip lockup speeds which I mistakenly thought were full lockup, which means that once it entered the region where it isn't fully locked up, it would always slip lockup and never disable it unless I was accelerating or in kickdown mode.

Funnily enough while perusing the code I found a small bug. Someone had inadvertently left a double copy of a variable which the compiler did not omit.

e.g

variable1 = somevalue
variable1 = somevalue



though it does make me wonder if they intended a different variable to be zeroed out there

Further analysis

The algorithm is quite convoluted and at times make no sense. At first we determine slip lockup state based on speed in kmh from ABS, then we have another piece of code calculating lockup state based on if cruise control is active or not again, based on speed from ABS.

But then full lockup algorithm depends on if we have slip locking enabled(thresholds are normal values), if we never reach these thresholds, we will neither slip lock nor full lock. If we choose to slip lock, only then do we get to the code path that calculates our regular lock speed but it calculates them not from ABS vehicle speed, but from output shaft speed.
BUT

there is one single control byte which is set to 0x2(slip locking enabled) if we disable this control byte(set to 0) our slip lockup maps become the DE FACTO full lockup maps because it skips most of the code and directly sets our mode to full lockup(0x04) but then these lockup speeds are ABS dependent. This configuration change has not been tested it's just what my static analysis reveals and I have spent a whole week on this big function.



And then the output shaft speeds



But these appear to be thresholds, there is another code path which finally decides where we jump(0x04 lockup)

And just in case it isn't clear:

vehicle speed km/h = output shaft speed * tyre circumference (in meters) * 60 / final drive * 1000
which becomes
1600 * 1.986(constant in TCM or fetched from CEM; standard 205/55/r16 tyre) * 60 * 2440 = 78km/h

Can you disable the slip? Change final drive ratio? Say, I want to install an XC90 final drive. Set non standard tire size?

The goal is to disable sliplockup. Final drive, Tyre circumference and gear ratios are all configurable, yes.

[dikidera]

I am pleased to announce I have disabled slip lockup. The slip lockup maps now become the default full lockup maps. There is only slight slip lockup during engaging of the torque converter and possibly during shifting, which is normal and required.