Vida CEM swapping

[Arty]

Hi all! I was very happy to find this thread long time ago, when I decided that I want to swap my M56 with M66. I understood that I have to config the CEM in order to have cruise control when in 6th gear and reverse lock.
Аt first I was disappointed because I read that getting the PIN is not possible for CEM-B, which I have in my 2001 S60. But recently I heard about OpenMoose so I got a laptop and got my CEM pin.
In the meantime though, I bought Teensy, CAN communicators and a used CEM from a scrapyard and started experimenting. The short story is that I can't make it work and any help would be appreciated.
So I am in the correct cem-b branch and when I run the code unmodified I get the "Unknown CEM part number 0...". I tried hardcoding the part number and other stuff, but with no success. Teensy seems to crash after "Reading RAM.." line.
I don't use additional 5V power to the board. I use 12V transformer for the CEM, powering E3, E6 and B3 (read this in the thread) and grounding E1. At first I have switched the CAN transceivers connections to the CEM but have fixed that.

There's Openmoose for CEM-B. I don't see why you'd want to build something on a Teensy.

[vtl]

Hi all! I was very happy to find this thread long time ago, when I decided that I want to swap my M56 with M66. I understood that I have to config the CEM in order to have cruise control when in 6th gear and reverse lock.
Аt first I was disappointed because I read that getting the PIN is not possible for CEM-B, which I have in my 2001 S60. But recently I heard about OpenMoose so I got a laptop and got my CEM pin.
In the meantime though, I bought Teensy, CAN communicators and a used CEM from a scrapyard and started experimenting. The short story is that I can't make it work and any help would be appreciated.
So I am in the correct cem-b branch and when I run the code unmodified I get the "Unknown CEM part number 0...". I tried hardcoding the part number and other stuff, but with no success. Teensy seems to crash after "Reading RAM.." line.
I don't use additional 5V power to the board. I use 12V transformer for the CEM, powering E3, E6 and B3 (read this in the thread) and grounding E1. At first I have switched the CAN transceivers connections to the CEM but have fixed that.

It perhaps needs K-Line to open diagnostic CAN-buses. I have a MC33290 K-Line chip added on my cracker, but never managed to reflect it in the schematics, since cracking via timing attack does not work with these CEMs. You can connect to CAN-HS and CAN-LS pins, which is only available if you have it on the table.

[mirelay]

There's Openmoose for CEM-B. I don't see why you'd want to build something on a Teensy.

I already got the code, but I wanted to have the cracker for future cars and to test.

It perhaps needs K-Line to open diagnostic CAN-buses. I have a MC33290 K-Line chip added on my cracker, but never managed to reflect it in the schematics, since cracking via timing attack does not work with these CEMs. You can connect to CAN-HS and CAN-LS pins, which is only available if you have it on the table.

1.jpg

2.jpg

Well, I will follow if you sometime in the future decide to update the schematics.

[vtl]

Well, I will follow if you sometime in the future decide to update the schematics.

I'm lazy... You need one resistor ~0.5K between VBAT and K-LINE. TX connects to Teensy TX3 (pin 14). K-LINE goes to OBD-II port pin 7.

kline.png (54.95 KiB) Viewed 931 times

Or if you are going to use it in car, better don't cheap out and make the full protection as per chip schematics.

[Hyppis]

Don't know if this is the right place, but seems like the most fitting thread for this problem and this was one of the threads I read the most.

I was trying to get my CEM PIN for my V70 MK2 for eventually programming power seats as one of the hall sensors gave out, so I tried it with Openmoose and managed to get the pin with Fast Recover Pin, and managed to do it, so I tried Check PIN, which then probably put it into programming mode, and now I'm pretty much stuck.

I've recently had such a flow fixing everything on this car and now I probably bit off more than I can chew, so any help would be appreciated here too!

[vtl]

Don't know if this is the right place, but seems like the most fitting thread for this problem and this was one of the threads I read the most.

I was trying to get my CEM PIN for my V70 MK2 for eventually programming power seats as one of the hall sensors gave out, so I tried it with Openmoose and managed to get the pin with Fast Recover Pin, and managed to do it, so I tried Check PIN, which then probably put it into programming mode, and now I'm pretty much stuck.

I've recently had such a flow fixing everything on this car and now I probably bit off more than I can chew, so any help would be appreciated here too!

So, what's the question? How to get it unstuck? Disconnect the battery if there's no button to get it unstuck.

[Hyppis]

Yes, sorry, that's exactly the question!

So do you know what has happened here? Do I just disconnect the battery and wait a while to get it out of programming mode?

[vtl]

Yes, sorry, that's exactly the question!

So do you know what has happened here? Do I just disconnect the battery and wait a while to get it out of programming mode?

Car "dies" when blocks go into programming mode. Either send an "undie" CAN message or disconnect the battery for a minute.

[Dudde]

Yes, sorry, that's exactly the question!

So do you know what has happened here? Do I just disconnect the battery and wait a while to get it out of programming mode?

Disconnect battery, you have CEM B so there is no "fast" way of changing car config for free through OBD

[Hyppis]

That worked!

Really interesting how there is absolutely zero information about that anywhere that I found (before now lol) so a big thank you!

It at least seems like I got the CEM PIN anyways, so is there any better way to check that it is the correct one?