Vida CEM swapping

[porcupine7655]

Implemented eeprom and flash programming to my V70 BiFuel CEM with M30855 cpu into my SBL.
Possible to read and write complete cem over can. Still running on Raspberry and SocketCan

Reading flash and eeprom in car

Code: Select all

$ python3 sblflasher.py
Bus sleep..........................................................................................
...................................................................................................
.........................................Bus idle
Check SBL running.. NO
Login using pin  86 80 40 63 98 78
Sending SBL......Done
Checking loaded SBL OK
Starting SBL Done
Check SBL running.. YES
Read or Write data? (r/w): r
Read memory 0xfb0000 -- 0xffffff.
  0xfb0000................
  0xfc0000................
  0xfd0000................
  0xfe0000................
  0xff0000................
  Checking CRC..OK
Read memory 0x0 -- 0x7ff.
  0x000000
  Checking CRC..OK
Read memory 0xffff00 -- 0xffff3c.
  0xffff00
  Checking CRC..OK
Finished, do you want to reset whole bus? (Y/N): y
Exiting, Restart bus.Done

You get some files,
raw binary dump of internal flash and eeprom
eeprom content is also decrypted and eeprom encryption key is also saved

Then writing backup CEM on bench

Code: Select all

$ python3 sblflasher.py
Bus sleep.............................................................................                                             ......................................................................................                                             ..................Bus idle
Check SBL running.. NO
Login using pin  48 29 92 02 88 17
Sending SBL......Done
Checking loaded SBL OK
Starting SBL Done
Check SBL running.. YES
Read or Write data? (r/w): w
Flash M32C85
  Check page fb0000--fbffff for changes..Changed
  Check page fc0000--fcffff for changes..Changed
  Check page fd0000--fdffff for changes..Changed
  Check page fe0000--feffff for changes..Changed
  Check page ff0000--ff7fff for changes..Changed
  Check page ff8000--ff9fff for changes..Changed
  Check page ffa000--ffbfff for changes..Changed
  Check page ffc000--ffdfff for changes..not changed
  Check page ffe000--ffefff for changes..Changed
  Check page fff000--ffffff for changes..Changed
Continue to flash changed pages? (Y/N): y
Flashing page fb0000--fbffff......................................................................................OK
Flashing page fc0000--fcffff......................................................................................OK
Flashing page fd0000--fdffff......................................................................................OK
Flashing page fe0000--feffff......................................................................................OK
Flashing page ff0000--ff7fff...........................................OK
Flashing page ff8000--ff9fff...........OK
Flashing page ffa000--ffbfff...........OK
Flashing page ffe000--ffefff......OK
Flashing page fff000--ffffff......OK
Flash 93LC86
  Check page 000000--00000f for changes..not changed
  Check page 000010--00001f for changes..Changed
  Check page 000020--00002f for changes..Changed
  Check page 000030--00003f for changes..Changed
  Check page 000040--00004f for changes..Changed
  Check page 000050--00005f for changes..Changed
  Check page 000060--00006f for changes..Changed
  Check page 000070--00007f for changes..not changed
  Check page 000080--00008f for changes..not changed
  Check page 000090--00009f for changes..not changed
  Check page 0000a0--0000af for changes..not changed
  Check page 0000b0--0000bf for changes..not changed
  Check page 0000c0--0000cf for changes..not changed
  Check page 0000d0--0000df for changes..not changed
  Check page 0000e0--0000ef for changes..not changed
  Check page 0000f0--0000ff for changes..not changed
  Check page 000100--00010f for changes..not changed
  Check page 000110--00011f for changes..not changed
  Check page 000120--00012f for changes..not changed
  Check page 000130--00013f for changes..Changed
  Check page 000140--00014f for changes..Changed
  Check page 000150--00015f for changes..Changed
  Check page 000160--00016f for changes..Changed
  Check page 000170--00017f for changes..Changed
  Check page 000180--00018f for changes..Changed
  Check page 000190--00019f for changes..not changed
  Check page 0001a0--0001af for changes..not changed
  Check page 0001b0--0001bf for changes..Changed
  Check page 0001c0--0001cf for changes..Changed
  Check page 0001d0--0001df for changes..Changed
  Check page 0001e0--0001ef for changes..Changed
  Check page 0001f0--0001ff for changes..Changed
  Check page 000200--00020f for changes..Changed
  Check page 000210--00021f for changes..Changed
  Check page 000220--00022f for changes..Changed
  Check page 000230--00023f for changes..Changed
  Check page 000240--00024f for changes..Changed
  Check page 000250--00025f for changes..Changed
  Check page 000260--00026f for changes..Changed
  Check page 000270--00027f for changes..Changed
  Check page 000280--00028f for changes..Changed
  Check page 000290--00029f for changes..Changed
  Check page 0002a0--0002af for changes..Changed
  Check page 0002b0--0002bf for changes..Changed
  Check page 0002c0--0002cf for changes..Changed
  Check page 0002d0--0002df for changes..Changed
  Check page 0002e0--0002ef for changes..Changed
  Check page 0002f0--0002ff for changes..Changed
  Check page 000300--00030f for changes..Changed
  Check page 000310--00031f for changes..Changed
  Check page 000320--00032f for changes..Changed
  Check page 000330--00033f for changes..Changed
  Check page 000340--00034f for changes..Changed
  Check page 000350--00035f for changes..Changed
  Check page 000360--00036f for changes..Changed
  Check page 000370--00037f for changes..Changed
  Check page 000380--00038f for changes..Changed
  Check page 000390--00039f for changes..Changed
  Check page 0003a0--0003af for changes..Changed
  Check page 0003b0--0003bf for changes..Changed
  Check page 0003c0--0003cf for changes..Changed
  Check page 0003d0--0003df for changes..Changed
  Check page 0003e0--0003ef for changes..Changed
  Check page 0003f0--0003ff for changes..Changed
  Check page 000400--00040f for changes..Changed
  Check page 000410--00041f for changes..Changed
  Check page 000420--00042f for changes..Changed
  Check page 000430--00043f for changes..Changed
  Check page 000440--00044f for changes..Changed
  Check page 000450--00045f for changes..Changed
  Check page 000460--00046f for changes..Changed
  Check page 000470--00047f for changes..Changed
  Check page 000480--00048f for changes..Changed
  Check page 000490--00049f for changes..Changed
  Check page 0004a0--0004af for changes..Changed
  Check page 0004b0--0004bf for changes..Changed
  Check page 0004c0--0004cf for changes..Changed
  Check page 0004d0--0004df for changes..Changed
  Check page 0004e0--0004ef for changes..Changed
  Check page 0004f0--0004ff for changes..Changed
  Check page 000500--00050f for changes..Changed
  Check page 000510--00051f for changes..Changed
  Check page 000520--00052f for changes..not changed
  Check page 000530--00053f for changes..Changed
  Check page 000540--00054f for changes..Changed
  Check page 000550--00055f for changes..Changed
  Check page 000560--00056f for changes..Changed
  Check page 000570--00057f for changes..Changed
  Check page 000580--00058f for changes..Changed
  Check page 000590--00059f for changes..Changed
  Check page 0005a0--0005af for changes..Changed
  Check page 0005b0--0005bf for changes..Changed
  Check page 0005c0--0005cf for changes..Changed
  Check page 0005d0--0005df for changes..Changed
  Check page 0005e0--0005ef for changes..not changed
  Check page 0005f0--0005ff for changes..Changed
  Check page 000600--00060f for changes..Changed
  Check page 000610--00061f for changes..Changed
  Check page 000620--00062f for changes..Changed
  Check page 000630--00063f for changes..Changed
  Check page 000640--00064f for changes..Changed
  Check page 000650--00065f for changes..Changed
  Check page 000660--00066f for changes..Changed
  Check page 000670--00067f for changes..Changed
  Check page 000680--00068f for changes..Changed
  Check page 000690--00069f for changes..Changed
  Check page 0006a0--0006af for changes..Changed
  Check page 0006b0--0006bf for changes..Changed
  Check page 0006c0--0006cf for changes..Changed
  Check page 0006d0--0006df for changes..Changed
  Check page 0006e0--0006ef for changes..Changed
  Check page 0006f0--0006ff for changes..Changed
  Check page 000700--00070f for changes..Changed
  Check page 000710--00071f for changes..Changed
  Check page 000720--00072f for changes..Changed
  Check page 000730--00073f for changes..not changed
  Check page 000740--00074f for changes..not changed
  Check page 000750--00075f for changes..not changed
  Check page 000760--00076f for changes..Changed
  Check page 000770--00077f for changes..Changed
  Check page 000780--00078f for changes..Changed
  Check page 000790--00079f for changes..Changed
  Check page 0007a0--0007af for changes..Changed
  Check page 0007b0--0007bf for changes..Changed
  Check page 0007c0--0007cf for changes..Changed
  Check page 0007d0--0007df for changes..Changed
  Check page 0007e0--0007ef for changes..Changed
  Check page 0007f0--0007ff for changes..not changed
Continue to flash changed pages? (Y/N): y
Flashing page 000010--00001f.OK
Flashing page 000020--00002f.OK
Flashing page 000030--00003f.OK
Flashing page 000040--00004f.OK
Flashing page 000050--00005f.OK
Flashing page 000060--00006f.OK
Flashing page 000130--00013f.OK
Flashing page 000140--00014f.OK
Flashing page 000150--00015f.OK
Flashing page 000160--00016f.OK
Flashing page 000170--00017f.OK
Flashing page 000180--00018f.OK
Flashing page 0001b0--0001bf.OK
Flashing page 0001c0--0001cf.OK
Flashing page 0001d0--0001df.OK
Flashing page 0001e0--0001ef.OK
Flashing page 0001f0--0001ff.OK
Flashing page 000200--00020f.OK
Flashing page 000210--00021f.OK
Flashing page 000220--00022f.OK
Flashing page 000230--00023f.OK
Flashing page 000240--00024f.OK
Flashing page 000250--00025f.OK
Flashing page 000260--00026f.OK
Flashing page 000270--00027f.OK
Flashing page 000280--00028f.OK
Flashing page 000290--00029f.OK
Flashing page 0002a0--0002af.OK
Flashing page 0002b0--0002bf.OK
Flashing page 0002c0--0002cf.OK
Flashing page 0002d0--0002df.OK
Flashing page 0002e0--0002ef.OK
Flashing page 0002f0--0002ff.OK
Flashing page 000300--00030f.OK
Flashing page 000310--00031f.OK
Flashing page 000320--00032f.OK
Flashing page 000330--00033f.OK
Flashing page 000340--00034f.OK
Flashing page 000350--00035f.OK
Flashing page 000360--00036f.OK
Flashing page 000370--00037f.OK
Flashing page 000380--00038f.OK
Flashing page 000390--00039f.OK
Flashing page 0003a0--0003af.OK
Flashing page 0003b0--0003bf.OK
Flashing page 0003c0--0003cf.OK
Flashing page 0003d0--0003df.OK
Flashing page 0003e0--0003ef.OK
Flashing page 0003f0--0003ff.OK
Flashing page 000400--00040f.OK
Flashing page 000410--00041f.OK
Flashing page 000420--00042f.OK
Flashing page 000430--00043f.OK
Flashing page 000440--00044f.OK
Flashing page 000450--00045f.OK
Flashing page 000460--00046f.OK
Flashing page 000470--00047f.OK
Flashing page 000480--00048f.OK
Flashing page 000490--00049f.OK
Flashing page 0004a0--0004af.OK
Flashing page 0004b0--0004bf.OK
Flashing page 0004c0--0004cf.OK
Flashing page 0004d0--0004df.OK
Flashing page 0004e0--0004ef.OK
Flashing page 0004f0--0004ff.OK
Flashing page 000500--00050f.OK
Flashing page 000510--00051f.OK
Flashing page 000530--00053f.OK
Flashing page 000540--00054f.OK
Flashing page 000550--00055f.OK
Flashing page 000560--00056f.OK
Flashing page 000570--00057f.OK
Flashing page 000580--00058f.OK
Flashing page 000590--00059f.OK
Flashing page 0005a0--0005af.OK
Flashing page 0005b0--0005bf.OK
Flashing page 0005c0--0005cf.OK
Flashing page 0005d0--0005df.OK
Flashing page 0005f0--0005ff.OK
Flashing page 000600--00060f.OK
Flashing page 000610--00061f.OK
Flashing page 000620--00062f.OK
Flashing page 000630--00063f.OK
Flashing page 000640--00064f.OK
Flashing page 000650--00065f.OK
Flashing page 000660--00066f.OK
Flashing page 000670--00067f.OK
Flashing page 000680--00068f.OK
Flashing page 000690--00069f.OK
Flashing page 0006a0--0006af.OK
Flashing page 0006b0--0006bf.OK
Flashing page 0006c0--0006cf.OK
Flashing page 0006d0--0006df.OK
Flashing page 0006e0--0006ef.OK
Flashing page 0006f0--0006ff.OK
Flashing page 000700--00070f.OK
Flashing page 000710--00071f.OK
Flashing page 000720--00072f.OK
Flashing page 000760--00076f.OK
Flashing page 000770--00077f.OK
Flashing page 000780--00078f.OK
Flashing page 000790--00079f.OK
Flashing page 0007a0--0007af.OK
Flashing page 0007b0--0007bf.OK
Flashing page 0007c0--0007cf.OK
Flashing page 0007d0--0007df.OK
Flashing page 0007e0--0007ef.OK
Finished, do you want to reset whole bus? (Y/N): y
Exiting, Restart bus.Done

Note that the PIN code for the "spare" cem is needed. After flashing the "original" pin code must be used if you want to run it again after "Restart bus" is done. If you answer No on "Reset whole bus" question at end and keep power to CEM you can restart flashing using already loaded SBL.

I attach all code needed to build and run. Please note that there is no checks about what you run it on. No checks that it is expected cpu, not checked that it is expected flash size. No check that it is expected eeprom type, no check that the eeprom have expected size etc. So be carefully what you run it on. USE AT OWN RISK!

[dikidera]

Very nice, thank you. A fine addition to my own RPI+Socketcan tooling. I never actually got a chance to even look at the CEM, I had so many issues i had to fix(and new ones popping up), BDM-ing into the dreaded ETM, and so on and so forth. And most importantly, completely rerouting and re-tuning the stepper motor(which I replaced completely).

For the stepper motor, I have done the following modifications: https://www.volvoforums.org.uk/forum/te ... ost5004392

Soon I will document the ETM's swap out with a good magnet shaft on a 2020 ETM.

EDIT:It just occurred to me you can reprogram your CEM to think it's a regular petrol car, then the car will not trigger the DTCs. Just a thought. As a bonus, your fuel level will show in right needle.

[porcupine7655]

As my car have now the gas tanks reached the magic 20 year age I'm not allowed to drive it anymore. Volvo have documented how to make the car safe for the roads again, remove the filling nipple and remove the tube between the gas tanks. I have not any clear indications from inspection companies if I'm allowed to do it myself.
If I do it I want to remove the whole system, less things that can break and give engine light. And most important to be able to change to a normal size gasoline tank. Original 30 liters is not much.

First step is to find out what must be done is the first "obvious" thing, to set the Bifuel setting in CEM to "Not Bifuel".
It is a good first step, several things happen
- Button to switch between gasoline and CNG have no function anymore
- Trip computer functions appear in DIM if ring is rotated
- Gasoline meter page is not in DIM anymore
Can't say if the normal tank meter now show level of gasoline or not. I only have very low level in tank so I can't say if needle moves or not. (In a BiFuel car tank meter show level of CNG and there is one extra page in DIM show level of gasoline)
Not tested what happens if I disconnect cables to various gas system components. If I get a fault code or not.

[porcupine7655]

Some more analysis of eeprom data. This information is probably already in this thread somewhere but can be informative to show it again (if anyone is interested). It is from my V70 BiFuel 2006 Denso ECU with CEM-L.

Sync data between CEM and Denso ECU.
In CEM eeprom data is in duplicate with crc, in denso ecu data is in triplets without crc.
Yellow and green are two different datablobs (blue are crc). Don't know how they are used, I only see that they are same.
I also have identified what I think is key data, only two is defined in my cem. Key 3-6 is in FF area in raw eeprom dump. So probably they are only written when key is added.

[dikidera]

It is unknown if the gasoline tank can be replaced with regular 65l one. Reason is different rear construction. But no one has measured anything.

As for the CEM stuff, this may be easier to figure out because everything is stored in the config block and I am sure it was documented somewhere in a CEMParams.txt. It is a matter of changing engine ID I think, rest the car will reconfigure itself.

Trip computer may need to be separately enabled in config block(disabled for Bifuel because it combines avg fuel data from both CNG and Petrol making data skewed)

Gasoline meter should automatically switch in DIM to needle not display. And very likely no DTC will trigger(when you remove CNG stuff) when you switch to Petrol car in CEM.

[WhizzMan]

As my car have now the gas tanks reached the magic 20 year age I'm not allowed to drive it anymore.

I am assuming this is a local regulation that requires the tank to be replaced or at least inspected after this period. Isn't there a way to get the tank replaced/certified again that is cost effective? Is this even checked with the yearly safety test? (Assuming EU country). I know that CNG tanks work with very high pressures so this limit on lifetime for the tank makes sense, but I would assume that a CNG specialist company can provide a replacement tank or recertification for just the tank?

[dikidera]

How would you recertify such a tank. You would need to xray it for any cracks caused by amortization aka metal fatigue.

[porcupine7655]

Here have been a lot of discussions about pressure testing tanks and give them more time. Some steel tanks it is allowed to do if manufacturer provide interval and how long time it can be extended. But this is only for steel tanks. example early V70 with a tank in the baggage room.
My car have two smaller steel tanks and one bigger composite tank. The composite tank is not possible to extend life on. It have limited life. Clear sign on it when it expires.
And here every car is checked every year. We have to remove all covers from the gas system so they can check for leaks, corrosion etc. But this 20 year limit is built into the car registry. They have a note there and when time comes you get a note from them saying you have to replace the tanks with new or remove the gas system if the car can drive on any other fuel. When done you must pass an inspection where it is checked that gas tanks is removed correctly and environmental friendly. Not allowed to just release remaining gas from tanks. You need to have a pump to fill it into an other container and have paper telling that it is correctly handled.
If all of this not done they make an issue on the car so it is not allowed to drive until fixed.

[WhizzMan]

How would you recertify such a tank. You would need to xray it for any cracks caused by amortization aka metal fatigue.

For commercial gas cylinders there is testing (welding gas mixes and such). I have no idea how they do this, but it is done. Not sure if they do it for composite tanks as well.

I know I can buy new tanks for my LPG system (and they don't expire) for not too much money. Maybe there is an option for the CNG as well?

[porcupine7655]

Thanks to this
viewtopic.php?p=657191
I have managed to do next small step with my V70 2006.

I only have one key.
So, first trying to follow what mikeak2001 do in his thread.
First step i need to do, enter security access. What key is needed here? It say it is three bytes long, can it be what I called "Syncro 1-3" in the eeprom I found (see post earlier in this thread). Entered just 367788, no error. So far good, but I get error when trying to read out Key Id1. Saying "Error, Security access denied".

So something wrong with security key. Reading all comments on the other thread, noticed that it must be prefixed with 0E. Now it works. I can readout ID1-6

Code: Select all

Tester -> CEM: 50 B9 63/ B9-Read Data Block By Offset/63-6C4 ID1
Complete Response: F9 63 D9 AB 5E 22
ID1 - ID code transponder 1 3 651 886 626,00 

Tester -> CEM: 50 B9 64/ B9-Read Data Block By Offset/64-6C4 ID2
Complete Response: F9 64 D9 AB 7C 66
ID2 - ID code transponder 2 3 651 894 374,00 

Tester -> CEM: 50 B9 65/ B9-Read Data Block By Offset/65-6C4 ID3
Complete Response: F9 65 00 00 00 00
ID3 - ID code transponder 3 0,00 

This matches what I have seen in my cem eeprom dump above. 2 keys defined.

I then read out the other immo stuff

Code: Select all

Tester -> CEM: 50 B9 61/ B9-Read Data Block By Offset/61-6C4 Security Code - Immo
Complete Response: F9 61 08 67 91 57 59 75
SEC. CODE - Immo Security code for crypt communication with ECM 9 240 913 074 549,00 

Tester -> CEM: 50 B9 62/ B9-Read Data Block By Offset/62-6C4 PIN - Immo
Complete Response: F9 62 36 77 88
PIN - Immo PIN used for to enter Preset mode 3 569 544,00 

Tester -> CEM: 50 B9 72/ B9-Read Data Block By Offset/72-6C4 Common transponder code
Complete Response: F9 72 98 AF 8E ED 7D A0 41 B9 F5 CD BD 2A
TR.CODE Common Transponder code 0,00 

This also matches what I have in eeprom, but now I have "Correct" names of them

Code: Select all

  134--143: 086791575975 CRC d418 OK               => Syncro 4-9 (ECU)         => Security Code - Immo
  144--15f: 98af8eed7da041b9f5cdbd2a CRC f5f1 OK   => Crypto key (Transponder) => Common transponder code
  160--16b: 36778800 CRC 8a47 OK                   => Syncro 1-3 (ECU)         => PIN - Immo
  16c--177: d9ab5e22 CRC ae62 OK                   => Key 1 ID
  178--183: d9ab7c66 CRC 0d76 OK                   => Key 2 ID
  184--18f:                                        => Key 3 ID
  190--19b:                                        => Key 4 ID
  19c--1a7:                                        => Key 5 ID
  1a8--1b3:                                        => Key 6 ID

Can I then add a key? I have some ID48 immo chips but no extra key blade. First step is just to find out how this function works.
Trying to run "62-Add a transponder" routine and just get errors. What is wrong?
Close examine pictures in other thread, there is some extra in the log, "80-Specified by the implementor" that I don't have.

So testing again, click on "62-Add a transponder" and add 80 to the command in middle of screen.
No error this time, good. Then once more, now with 20
Go as expected (my original key in lock)

Code: Select all

Tester -> CEM: 50 B2 62 20/ B2-Control Routine By Offset (Activation)/62-Add a transponder/20-Specified by the implementor
Complete Response: F2 62 14 12 02
Answer code              TP_PROG_ALREADY_PROG-
Number of keys in memory No 2

Good, but how do I do when I only have one keyblade and it already have one immo chip. Don't want to break the plastic to remove the chip.
Wrapping aluminium foil didn't help.

First idea was to mill out one in the cnc. Started to measure up the key with the caliper and draw it up in the cad. Then I got the idea, why do I not go the simple road and just try to 3d print it. I didn't expect it but it did actually work in first try! I had a key I can turn without immo chip. Starter does not activate. Holding original key near and it starts.

Now I can try to add it when holding the ID48 chip near lock, success at first try

Code: Select all

Tester -> CEM: 50 B2 62 80/ B2-Control Routine By Offset (Activation)/62-Add a transponder/80-Specified by the implementor
Complete Response: F2 62 01

Tester -> CEM: 50 B2 62 20/ B2-Control Routine By Offset (Activation)/62-Add a transponder/20-Specified by the implementor
Complete Response: F2 62 14 01 03
Answer code              Routine performed OK
Number of keys in memory No 3

I can start my car with plastic key!