Login Register

Vida CEM swapping

A mid-size luxury crossover SUV, the Volvo XC90 made its debut in 2002 at the Detroit Motor Show. Recognized for its safety, practicality, and comfort, the XC90 is a popular vehicle around the world. The XC90 proved to be very popular, and very good for Volvo's sales numbers, since its introduction in model year 2003 (North America). P2 platform.
Post Reply
vtl
Posts: 4727
Joined: 16 August 2012
Year and Model: 2005 XC70
Location: Boston
Has thanked: 114 times
Been thanked: 606 times

Re: Vida CEM swapping

Post by vtl »

dikidera wrote: 20 Oct 2024, 14:44 The other subject I want to touch on is again the transmission. Our 5-speed transmissions are driven by algorithms, models which:
A) Were developed in the 90s and are not as advanced
B) Expect that the condition of the gearbox will be immaculate the whole time. Perfect TC clutch, perfect friction plates. Non-sticking solenoids.
C) Approximate many physical phenomena without measuring most of them.

Because these algorithms were developed a time where compute power was not that great, the algorithms are sometimes very simple and not that accurate. I don't claim to understand them. This is why these gearboxes die all of a sudden and had no codes prior.

On the other hand we have the 6-speed TF80SC which features entirely different algorithms. The code is denser(by a factor of 4 at least), uses a lot of floating point math(the 5-speed does not) as such it probably has a better approximation of various physical phenomena, torque transfer etc. More is not always better, but in this case it probably is. I expect the 6-speed to be more durable and resist wear.

The adaptation algorithm for the 5-speed is very "simple", I am speaking from memory, but it's something along the lines of a static table of oil temp regions and gears. The oil temp regions are -15, 0, 15, 40, 65 and 110 if I remember correctly. Then these tables have a value between 0 and 4.

And depending on this value, the adaptation of one temp region and gear is added with that from another.

Now because there is no finer granularity here, when the transmission adapts a shift say at 100c, it will use that adaptive value at 65c because they are both of the same temp region, because, again, no finer granularity. What about that table and summation of the adaptations? It's static and not very adaptive.

The adaptations are also not grouped by RPM, no such concept.

Finally, the TCM firmware assumes that when it commands 70 psi of pressure for main lube, that it will in fact be 70 psi, but any sticking solenoids, pressure loss from internal leaks or not as good oil characteristics, it can all go downhill from there.
It is still better than transmissions developed earlier, because it moved away from pure mechanical control with no compensation at all to electronically controlled one! ;)

TF80 in wife's ex XC60 wasn't very smooth. In fact, when we bought it knew, it was banging so hard that I found pieces of clutches doing ATF drain and fill. It required a TCM software update later. The word was Volvo did a crappy job replacing 3.2l I-6 engine with yet another iteration of I-5 turbo.

Same era Aisin-made A760/AB60 are hit or miss. The one in my Tundra has a slight problem with 2nd gear when cold and a lot of kicking when stuck in traffic, which reminds me AW55 so much. The same engine/transmission combo in wife's Sequoia is always silk smooth. They're also are not know for premature death and are good for like 0.5M miles.

Reports on newer 8 and 10-speed Aisins are anywhere from "shudder" to silk smooth, on brand new vehicles.

Nothing replaces a human being who shifts a manual gearbox. Humans adapt quickly.

vtl
Posts: 4727
Joined: 16 August 2012
Year and Model: 2005 XC70
Location: Boston
Has thanked: 114 times
Been thanked: 606 times

Post by vtl »

nikemen wrote: 20 Oct 2024, 11:51
vtl wrote: 14 Oct 2024, 09:00 No common ground between OBD connector and Teensy? The original schematic has it:
I added the common ground, but no change, there is still no connection to the car.
Then I took a look at the repository again, and I found a schematic for the use of Bosch CF160 transceivers: no common ground nor any resistor there... so my setup is apparently OK, I can't imagine where the problem comes from.

Capture d’écran 2024-10-20 à 2.49.22 PM.png
Almost any digital electric circuit needs a common ground between its parts.

Try it with door open, but without key. With key in position 0, 1 or 2. Remove CEM_PN_AUTODETECT: https://github.com/vtl/volvo-cem-cracke ... er.ino#L14 (in that case you may need to tweak LS/HS speed according to what your vehicle has: https://github.com/vtl/volvo-cem-cracke ... .ino#L1354)

dikidera
Posts: 1304
Joined: 15 August 2022
Year and Model: S60 2005
Location: Galaxy far far away
Has thanked: 67 times
Been thanked: 175 times

Post by dikidera »

vtl wrote: 22 Oct 2024, 05:06
dikidera wrote: 21 Oct 2024, 14:45 I think I found a bug, but not sure

Image

Why set the flag to 1 but then immediately overwrite it? It could potentially be read as 1 IF an interrupt is generated at just the right time but 12 instructions at 1-2 clock cycles, doesn't very plausible.

The code that reads this flag is an interrupt handler and may or may not be detecting a revolution change. And this flag determines which code path is executed in the handler. By always setting it to 0 the code path may not be executed.
Is it op src dst format or dst src? Also what does # and @ mean? # looks like an immediate, @ is a reference? It looks like a code typically generated by a very old gcc, 2.x or 3.x, before ~4.4 when it has got a new static single assignment optimizer.
Yep, src -> dst, @ is more like *(dereference) e.g mov into what register is pointing to. #unk is just how IDA labels the memory addresses, you can see memory address FFF96D0 is assigned a 1, but a few instructions later it is assigned a 0. Could be an old GCC, yes, there are many many redundant instructions in the whole code base.

dikidera
Posts: 1304
Joined: 15 August 2022
Year and Model: S60 2005
Location: Galaxy far far away
Has thanked: 67 times
Been thanked: 175 times

Post by dikidera »

vtl wrote: 22 Oct 2024, 05:36
dikidera wrote: 20 Oct 2024, 14:44 The other subject I want to touch on is again the transmission. Our 5-speed transmissions are driven by algorithms, models which:
A) Were developed in the 90s and are not as advanced
B) Expect that the condition of the gearbox will be immaculate the whole time. Perfect TC clutch, perfect friction plates. Non-sticking solenoids.
C) Approximate many physical phenomena without measuring most of them.

Because these algorithms were developed a time where compute power was not that great, the algorithms are sometimes very simple and not that accurate. I don't claim to understand them. This is why these gearboxes die all of a sudden and had no codes prior.

On the other hand we have the 6-speed TF80SC which features entirely different algorithms. The code is denser(by a factor of 4 at least), uses a lot of floating point math(the 5-speed does not) as such it probably has a better approximation of various physical phenomena, torque transfer etc. More is not always better, but in this case it probably is. I expect the 6-speed to be more durable and resist wear.

The adaptation algorithm for the 5-speed is very "simple", I am speaking from memory, but it's something along the lines of a static table of oil temp regions and gears. The oil temp regions are -15, 0, 15, 40, 65 and 110 if I remember correctly. Then these tables have a value between 0 and 4.

And depending on this value, the adaptation of one temp region and gear is added with that from another.

Now because there is no finer granularity here, when the transmission adapts a shift say at 100c, it will use that adaptive value at 65c because they are both of the same temp region, because, again, no finer granularity. What about that table and summation of the adaptations? It's static and not very adaptive.

The adaptations are also not grouped by RPM, no such concept.

Finally, the TCM firmware assumes that when it commands 70 psi of pressure for main lube, that it will in fact be 70 psi, but any sticking solenoids, pressure loss from internal leaks or not as good oil characteristics, it can all go downhill from there.
It is still better than transmissions developed earlier, because it moved away from pure mechanical control with no compensation at all to electronically controlled one! ;)

TF80 in wife's ex XC60 wasn't very smooth. In fact, when we bought it knew, it was banging so hard that I found pieces of clutches doing ATF drain and fill. It required a TCM software update later. The word was Volvo did a crappy job replacing 3.2l I-6 engine with yet another iteration of I-5 turbo.

Same era Aisin-made A760/AB60 are hit or miss. The one in my Tundra has a slight problem with 2nd gear when cold and a lot of kicking when stuck in traffic, which reminds me AW55 so much. The same engine/transmission combo in wife's Sequoia is always silk smooth. They're also are not know for premature death and are good for like 0.5M miles.

Reports on newer 8 and 10-speed Aisins are anywhere from "shudder" to silk smooth, on brand new vehicles.

Nothing replaces a human being who shifts a manual gearbox. Humans adapt quickly.
Sorry to hear for the bad experience, but remember Volvo said these are sealed for life and never need an oil change :D

I'm no engineer, but one fatal mistake is the lack of pressure sensors in transmissions. This way no approximation is needed and more erroneous conditions can be detected early.

vtl
Posts: 4727
Joined: 16 August 2012
Year and Model: 2005 XC70
Location: Boston
Has thanked: 114 times
Been thanked: 606 times

Post by vtl »

dikidera wrote: 22 Oct 2024, 06:50 I'm no engineer, but one fatal mistake is the lack of pressure sensors in transmissions. This way no approximation is needed and more erroneous conditions can be detected early.
What? You want to use your belongings you bought for your own, hard earned cash forever? It will drive every manufacturer out of business! In fact, what governments really need to do is for make a 2 year lease the only legit option. This would make the most sense. A law abiding citizen would be always paying for a new car credit, banks making profits, shareholders approving return on investment, third world countries getting endless influx of lightly used but already disintegrating junk. But that's their problem.

nikemen
Posts: 10
Joined: 9 January 2023
Year and Model: 2012 C30 T5
Location: Buenos Aires
Has thanked: 3 times
Been thanked: 1 time

Post by nikemen »

vtl wrote: 22 Oct 2024, 05:42 Almost any digital electric circuit needs a common ground between its parts.

Try it with door open, but without key. With key in position 0, 1 or 2. Remove CEM_PN_AUTODETECT: https://github.com/vtl/volvo-cem-cracke ... er.ino#L14 (in that case you may need to tweak LS/HS speed according to what your vehicle has: https://github.com/vtl/volvo-cem-cracke ... .ino#L1354)
About the common ground: I hear what you say and I went and did soldier a cable bridging it, to no avail. I don't discuss, frankly, I understand nothing... but did you see the schematic I attached? I took it from the current version of the repository (https://github.com/vtl/volvo-cem-cracke ... ersion.pdf) and it doesn't have that common ground. Is that schematic wrong, then?
I've tried with all key positions and with no key at all, the result was always the same. Didn't know about the door, I'll do that now.
The PCB I got from PCBWay was published by you, right? I gather if I solder a header to each side of the Teensy 4 and then to the PCB and also solder correctly a couple of Bosch CF160 and a cable to the 4 marked pins of the OBD connector it should work, with no resistance, right?
Maybe I didn't say it before, but the car is P1, a 2012 T5 C30. From what I see in the code the CEM_PN_AUTODETECT should be connected for P2, right?

vtl
Posts: 4727
Joined: 16 August 2012
Year and Model: 2005 XC70
Location: Boston
Has thanked: 114 times
Been thanked: 606 times

Post by vtl »

nikemen wrote: 22 Oct 2024, 12:34
vtl wrote: 22 Oct 2024, 05:42 Almost any digital electric circuit needs a common ground between its parts.

Try it with door open, but without key. With key in position 0, 1 or 2. Remove CEM_PN_AUTODETECT: https://github.com/vtl/volvo-cem-cracke ... er.ino#L14 (in that case you may need to tweak LS/HS speed according to what your vehicle has: https://github.com/vtl/volvo-cem-cracke ... .ino#L1354)
About the common ground: I hear what you say and I went and did soldier a cable bridging it, to no avail. I don't discuss, frankly, I understand nothing... but did you see the schematic I attached? I took it from the current version of the repository (https://github.com/vtl/volvo-cem-cracke ... ersion.pdf) and it doesn't have that common ground. Is that schematic wrong, then?
I've tried with all key positions and with no key at all, the result was always the same. Didn't know about the door, I'll do that now.
The PCB I got from PCBWay was published by you, right? I gather if I solder a header to each side of the Teensy 4 and then to the PCB and also solder correctly a couple of Bosch CF160 and a cable to the 4 marked pins of the OBD connector it should work, with no resistance, right?
Maybe I didn't say it before, but the car is P1, a 2012 T5 C30. From what I see in the code the CEM_PN_AUTODETECT should be connected for P2, right?
PDF was published by RickHaleParker. Who did that PCB I don't know, maybe Rick as well. No common ground is a miss in my opinion, but it may work because of differential signalling that CAN bus uses. Common ground is still desirable.

The whole project was started in 2020 by T5Luke and me, but it has many contributors joined later on. He and myself did a lot, but not everything.

nikemen
Posts: 10
Joined: 9 January 2023
Year and Model: 2012 C30 T5
Location: Buenos Aires
Has thanked: 3 times
Been thanked: 1 time

Post by nikemen »

The PCB was published under the name "Kiel Bryant". Anyway, I had no luck.
I had my doubts about the soldering of the CF160, because pin 1 wasn't signaled by a dot, but I saw under the microscope there is a chamfer on one side of the chip, took a look on the documentation and can confirm they were both soldered to the PCB in the right direction.
I'd like to find here someone that's used that PCB with the Bosch chips and maybe point me in the right direction. If I don't, I'll ask a friend to do it for me following the diagram but with DuPont cables instead of the PCB and keep trying.
You say I should disable CEM_PN_AUTODETECT even if my car is P1? Where can I find the values to tweak LS/HS speed for a C30?

vtl
Posts: 4727
Joined: 16 August 2012
Year and Model: 2005 XC70
Location: Boston
Has thanked: 114 times
Been thanked: 606 times

Post by vtl »

nikemen wrote: 22 Oct 2024, 14:11 You say I should disable CEM_PN_AUTODETECT even if my car is P1? Where can I find the values to tweak LS/HS speed for a C30?
Why "even"? It's for any P. For those cases when the cracker can not sense who he is talking to.

I don't know about the speeds. In the best case someone in this great thread will jump in and say what the speeds are. In worst case you figure it out on your own. There's only 3 CAN speeds in these Volvos anyways, so iterating over them won't take much time.

nikemen
Posts: 10
Joined: 9 January 2023
Year and Model: 2012 C30 T5
Location: Buenos Aires
Has thanked: 3 times
Been thanked: 1 time

Post by nikemen »

vtl wrote: 22 Oct 2024, 15:55 Why "even"? It's for any P. For those cases when the cracker can not sense who he is talking to.
Because of what it says in the code:

Code: Select all

comment out for P2 CEM-L on the bench w/o DIM
I'm sorry, I'm trying to understand.

Post Reply
  • Similar Topics
    Replies
    Views
    Last post