Vida CEM swapping

[vtl]

Today I did some experiments.

I increased the clutch fill time from ~250 to 350ms for 2nd->3rd shift, oh boy did it not like that. Fairly violent shifts. While I have set a cap on torque reduction to 150nm, it felt like I went below 20 but the logs still show 150nm only. I cannot explain why this was, maybe increasing the clutch fill time caused it to partially engage, while the offgoing clutch was still engaged, basically having two clutches on at the same time, for a split moment.

And in other news, I have also discovered from my logs that once in a while, the feedback current of SLS solenoid differs wildly from commanded. Example is SLS commanded current of 765 milliAmps causes for a split second a feedback current of 1022 milliAmps. And since more current = less pressure, then 1.02 amps = 0 pressure for SLS. Somehow something is propelling the solenoid plunger backwards.

You may see a signal overshoot https://en.wikipedia.org/wiki/Overshoot_(signal)

[Yariy]

Hello everyone, please test the program for reading and writing flash via BDM, configuration changes, writing and reading configuration via OBD (J2534), Volvo CEM blocks (S60, S80, V70, XC90) 2002 - 2004 based on CEMB MC68376 28F400. The BDM device is based on the Weact-STM32G431CBU6 mini core board. The scheme and firmware of the device for connecting via BDM to CEM is present in the program. You can flash the Weact-STM32G431CBU6 device through the program. At the moment, there is no provision for recording the BOOT flash area, but this can be quickly fixed. The time to read and write the full BDM flash image is about 6 minutes. The recording time of the J2534 configuration is no more than 1 minute. To record the configuration of the OBD J2534, you must have the original 28F400 full flash dump. Tested on J2534 devices: Volvo Dice, Scanmatik 2 Pro. The program is in test mode, all actions are performed at your own risk!

https://disk.yandex.ru/d/9i4f8ix5f6Odhg

[dikidera]

Today I did some experiments.

I increased the clutch fill time from ~250 to 350ms for 2nd->3rd shift, oh boy did it not like that. Fairly violent shifts. While I have set a cap on torque reduction to 150nm, it felt like I went below 20 but the logs still show 150nm only. I cannot explain why this was, maybe increasing the clutch fill time caused it to partially engage, while the offgoing clutch was still engaged, basically having two clutches on at the same time, for a split moment.

And in other news, I have also discovered from my logs that once in a while, the feedback current of SLS solenoid differs wildly from commanded. Example is SLS commanded current of 765 milliAmps causes for a split second a feedback current of 1022 milliAmps. And since more current = less pressure, then 1.02 amps = 0 pressure for SLS. Somehow something is propelling the solenoid plunger backwards.

You may see a signal overshoot https://en.wikipedia.org/wiki/Overshoot_(signal)

Unsure. Maybe a sticky solenoid?

So far I have the following maps:
Shift points
Lockup maps
Clutch fill pressures
Clutch fill times
Shift times (potentially).

I have pretty much all I need. This is all for upshifting. For downshifts it's a different ball game.

Addendum: After modifying the initial clutch fill pressures, from a raw value of 64 PSI to 78, the 2-3 shift has mighty improved. However I only drove it very little. I need to see how it behaves in very very high temps and over time with adaptations.
In the AW55 patents it is mentioned that the initial clutch fill pressure + fill time heavily affects shifting quality. They appear to have been correct.

This is why I did the work, to get a nice smooth, better shifting. I am happy I made all this progress.

[leapdragon]

Hello all, I have managed to bork my CEM (2002 V70XC) via a failed VIDA update... CEM is offline and despite being able to see it, VIDA doesn't seem to want to reflash it with a CEM reload (or update) leaving me with a 100% disabled vehicle.

Since it seems a shame to toss out a whole car because the CEM needs a flash, vtl has pointed out to me that the folks in this thread may have some skill in reflashing CEMs w/o the whole VIDA song and dance.

Can anyone here help a relative novice with steps to pull a CEM and reflash it w/o VIDA? (Note that it was working perfectly well until the failed software upgrade).

I have soldering tools and even a couple Arduino units laying around, though I haven't done much with them yet. Any starting points appreciated!

[Yariy]

assemble BDM readers using this example https://www.drive2.ru/l/582381898370814757 / and then post it here, but don't program it yet

[gavik]

Hello. In this topic there is a tool CEM flash reader which works perfectly. Tell me, is there a tool that can load the firmware back into CEM H using Dice?

[oscilloscope]

assemble BDM readers using this example https://www.drive2.ru/l/582381898370814757 / and then post it here, but don't program it yet

interesting piece of software , do you have a git for the code? for the BDM board?

[oscilloscope]

Hello everyone, please test the program for reading and writing flash via BDM, configuration changes, writing and reading configuration via OBD (J2534), Volvo CEM blocks (S60, S80, V70, XC90) 2002 - 2004 based on CEMB MC68376 28F400. The BDM device is based on the Weact-STM32G431CBU6 mini core board. The scheme and firmware of the device for connecting via BDM to CEM is present in the program. You can flash the Weact-STM32G431CBU6 device through the program. At the moment, there is no provision for recording the BOOT flash area, but this can be quickly fixed. The time to read and write the full BDM flash image is about 6 minutes. The recording time of the J2534 configuration is no more than 1 minute. To record the configuration of the OBD J2534, you must have the original 28F400 full flash dump. Tested on J2534 devices: Volvo Dice, Scanmatik 2 Pro. The program is in test mode, all actions are performed at your own risk!

https://disk.yandex.ru/d/9i4f8ix5f6Odhg

oops i meant this software not the previous quoted post

[Yariy]

assemble BDM readers using this example https://www.drive2.ru/l/582381898370814757 / and then post it here, but don't program it yet

interesting piece of software , do you have a git for the code? for the BDM board?

if you meant do I have the code on github, then no, but I can share it here if it's interesting.

[leapdragon]

Okay, so I have resolved my borked CEM issue with VIDA basically by doing rain dances and offering prayers. But it makes me think that the CEM cloning discussion is a good one to have in case I ever need to do this.

I was helpfully directed to this thread, but it's hard to know where to begin.

- It is a good idea to pre-emptively dump the CEMs of my two cars, in case I ever need to restore to a new unit?
- Assuming I have one "brick" and one "L" CEM (2002 V70XC, 2007 XC70) can anyone point me to the simplest path ahead to get started dumping these to long-term storage?

Looks like https://www.drive2.ru/l/582381898370814757 for the "brick," yes? Is there anything similar for the "L"?

And also—I feel like I see two separate discussions going on in this thread, one about cracking PIN, another about bench reading/writing flash. I feel dumb, but I have been unable to (by skimming) figure out the significant of the PIN discussion, at least not in detail.

Presumably there are either code signing or encryption at issue and this is what the PIN is talking about. But then how does this relate to a simple dump? So is the PIN just for when you want to do edits to the image for tuning (and thus need to re-sign, or need to decrypt), or is this PIN used somewhere else?

Forgive me for wasting time. (But this thread is almost 400 pages!)