Vida CEM swapping

[dikidera]

A few pages back there were some pictures of different L-shaped CEMs.
The ones with extra components could be used as replacement for those without, but not the other way around.
Software must also match.

For an engine swap, the CEM is not the main problem.
Your engine controller has to stream the correct data on the CAN bus for the complete network to understand.

In flash there is a portion of data that is called signal configuration.
This is where CAN signals and addresses for communication between controllers, is found.
I was just looking at my EDC16 now, and it is a little bit complicated to find the link between bytes in the signal configuration and datastream.

Example
0x1200021 00001001 000 000 00000000 01000010 09 - - 00 42 -- 09 18 00 42

My EDC will respond with CAN-ID 0x1200021 to a request from 0x000FFFFE
The 29-bit CAN id is split into several parts in the CAN registers of the MPC555 CPU.
The first part is 09, then the next six bits are not in line, then 8-bits are OK, and the last 8 bit are moved 1 step to the left.

Searching for 09 something something 00 42 resulted in 09 18 00 42 in the signal configuration.

0x1200021 will be something like 0x09180042 in signal configuration.

Other found:
0x62401E 03 1C 80 3C
0x80401E 04 18 80 3C
0xA20016 05 1C 00 2C
0x1400006 0A 18 00 0C
0x1600012 0B 18 00 24
0x10C00002 96 18 00 04
0x11C00002 8E 18 00 04
0xF00006 07 98 00 0C
0x18DAF110 C6 DD E2 20

Are these bits always like this? six bits are zero and then 8 are ok?

[prometey1982]

I am afraid it doesn't work like that over here at least where I am from. Price of cars skyrocketed and wages(which were not rising) were left in the dust after a year of inflation of probably double digits every month. A car previously costing the equivalent of 2000 dolars, is now 3500-4000 or higher.

You can buy cheap car with 2.3T engine in Poland. And just swap all the internals. I don't know current prices but some years ago cars in Poland were very cheap. And as the last change is buying car in UK. Not for drive but as parts donor. UK's car will have rusts body but in your case it's doesn't matter.

[rkam]

> Are these bits always like this? six bits are zero and then 8 are ok?

No this is just an example to show one of the things that can be tricky.

I've never studied the signal configuration until yesterday, and decided to check if I could find any of the CAN-IDs that the EDC16 in my XC70 is using in its signal configuration.
Since I couldn't find any of them stored directly I found a datasheet of the CPU to see how the 29-bit extended CAN ID was stored in the CPU registers.
Spreading the bits of my known CAN-ID into how it would be stored in the CPU registers, I started by searching for 42.

A different CPU will store the CAN-ID differently.
A different software could store the CAN-ID differently.
Some software in some controller might store them as full numbers if you are lucky.

MPC555-CAN-ID.png (125.1 KiB) Viewed 2077 times

[dikidera]

I think I got what you meant, but I always thought all the bits were assembled into on contiguous CANID. Specifically

can_id += bits[28-18]
can_id += bits[17-15]
can_id += bits[14-0]

And they are all coded in BCD?

So to summarize, the problem with going Denso->Bosch is that the module chain will not be able to speak to the ECM and vice-versa because different CAN-IDs? And that maybe the Bosch EDC may also send the data in different format, such as factors and such?

In denso, the factor for RPM is 0.1953125 or x*12800/65536 but for Bosch ME7 is x*40 and so the TCM will expect it one format from Denso, but now it's in ME7 format. Or maybe the speed in KM/h if it's being relayed to the safety modules is in different format also. Which means even i could fix the CAN-IDS I also need to make the EDC send the data in the correct format.

Is this also why I've heard of many people trying to swap one Electronic Throttle Module for another of the same make, because they fail so much and only a handful get it to work?

[prometey1982]

In denso, the factor for RPM is 0.1953125 or x*12800/65536 but for Bosch ME7 is x*40 and so the TCM will expect it one format from Denso, but now it's in ME7 format

There is different RPMs inside ME7. nmot - rpm/40. nmot_w - rpm * 4. TF80 TCM received nmot = rpm. I think that TCM receives actual rpm in CAN message without scaling.

[rkam]

0x1200021 is 000010010000000000000001000010 in contiguous binary bits.

But in MPC555 this value is stored in 4 bytes mixed with some other stuff.

$2: 00001001 $3:000**000 So the highest byte will be 09, the next could me mixed with SRR and IDE bits.

$4: 00000000 $5:0100001* Third byte is in this case clean 00, fourth byte is lowest 7 bits of CAN-ID + RTR bit.

If we assume RTR is 0, then the last byte is 01000010 which is 0x42

This is quite possible one of the reasons moving stuff from one vehicle to another is problematic.

[dikidera]

This is how it is in Denso as well, the SH7055 controller splits the can id and ext id between some bytes, but I always assumed they were re-assembled in the can ID we see in the logs with no extra bits or bytes.

For instance my bench ECU replies with 0x0080021 for 000FFFFE. And this is what I assume to be the real can ID, but if it is BCD encoding, then only 4 bits for 0-9 but the ID is 29 bits, so one bit is not needed.

However if the can ID is not reassembled and is output directly then maybe it needs re-ordering.

In Denso even the order of the bits is different.

[rkam]

The CAN-IDs we see on the Can bus logs are correct and contain just the 29 bits

0x0080021 is 00000000010000000000000100001 in binary (BCD?) and 524321 in decimal.
Here the bits are shown with Most Significant Bit to the left and Least Significant Bit to the right.
EXD_ID17 - EXD_ID0 followed by STD_ID10 - STD_ID0 totally 18 extended + 11 standard ID bits.

The extra bits that may be stored in between in the can controller registers are not shown on the CAN bus

[vtl]

And when I said cheaper, I still meant if I do it myself. My mechanic actually told me a while back to drive it as-is until it dies. He actually said it's not worth it to replace the engine, because we are talking about an entire overhaul(re-ringing, re-honing the block, polishing the crankshaft and maintenance on the head such as new valve seals etc).
I will know more as soon as I open the engine which will not be for a few more weeks. It all depends on the state of the current block.

Your guy is right. But replacing your N/A engine with turbo means you have to go that route on the donor engine as well. Especially turbo, since it wears out much quicker.

No need to polish crankshaft. It is a superior parts that Volvo should be very proud of. Unless the engine was oil starved, nothing happens to the crankshaft. I didn't even bother replacing the main bearings in my engine, because nothing was wrong with the crankshaft and even main bearings in the engine that I took apart before doing mine, yet that engine was in generally a worse shape than mine. I haven't found any critical mechanical wear in any part.

Also, it seems that Volvo engine parts are cheaper in Europe. For example, people reported they've paid much less for Mahle piston rings than I did in US.

Car prices went up here as well during COVID. I've paid $2200 for the donor XC70 in 2017. Have seen crappier XC70s with more miles, asked for twice as much in 2020-21. Sadly, car parts are also much more expensive now.

[liamstears]

Hi all, just a quick question if I may, got myself a teensy for cem pin cracking, I bought the PCB but couldn't find the Bosch CF160 so went with the SN65HVD230DR's instead. Cracked my P2 XC90 no problem in just under 35 minutes.

So the question is regarding time and resistors. I've read that the teensy should be pretty quick, is the time mines taken right or a bit longer than expected? What I wondered is if the resistors I added may have slowed the process? Being as I used the SN65HVD230DR's instead of the CF160's I added the 2 10k resistors from pin 8 to ground and wondering if maybe I didn't need to?....

Thanks in advance to anyone that can help and thanks to all that made the process of cracking the CEM this way possible as it's made my life much easier, thanks