rkam
Full Member
Karma: +4/-0
 Offline
Posts: 55
|
 |
« Reply #1965 on: December 12, 2022, 11:34:01 AM »
|
|
|
The FF in FF 86 means you are sending the command 86 to enter programming mode to all (FF) controllers.
This is normal when you are going to program a controller, because you want the complete car to go quiet.
My 7055 Denso can read memory with the A7 command in the area 6000 to DFFF.
|
|
|
|
|
Logged
|
|
|
|
dikidera
Full Member
Karma: +8/-8
Offline
Posts: 149
|
|
« Reply #1966 on: December 12, 2022, 12:04:37 PM »
|
|
|
The FF in FF 86 means you are sending the command 86 to enter programming mode to all (FF) controllers.
This is normal when you are going to program a controller, because you want the complete car to go quiet.
My 7055 Denso can read memory with the A7 command in the area 6000 to DFFF.
I think I see what you mean. So if I do 7A(7a being the ECM)86, then only this particular module will enter this programming mode? But yes, the whole car should be quiet, as far as I know. But..what happens instead is, the CEM resets the whole car, and we're back to the shouting CAN bus. I must be missing something then? Or maybe I am not missing anything and just need to make sure my RPI is powered at all times, which I will of course. |
|
|
|
« Last Edit: December 12, 2022, 12:16:06 PM by dikidera »
|
Logged
|
|
|
|
rkam
Full Member
Karma: +4/-0
Offline
Posts: 55
|
|
« Reply #1967 on: December 12, 2022, 01:28:16 PM »
|
|
|
You should make sure that all controllers on both high speed and low speed network is in programming mode if you want to program any controller in the car.
I'm sending FF 86 messages on both channels with 5ms interval for a duration of 4 seconds.
|
|
|
|
|
Logged
|
|
|
|
dikidera
Full Member
Karma: +8/-8
Offline
Posts: 149
|
|
« Reply #1968 on: December 12, 2022, 01:33:41 PM »
|
|
|
You should make sure that all controllers on both high speed and low speed network is in programming mode if you want to program any controller in the car.
I'm sending FF 86 messages on both channels with 5ms interval for a duration of 4 seconds.
I currently have no concept of high-speed low speed and for J2534, channels are abstract concepts. All I've read so far has shown that canbus operates at one bitrate. And the HIGH/LOW signals are just differential signals and nothing more. Perhaps you meant LINBUS, in which case I have no transceiver for that bus. |
|
|
|
« Last Edit: December 12, 2022, 01:46:03 PM by dikidera »
|
Logged
|
|
|
|
rkam
Full Member
Karma: +4/-0
Offline
Posts: 55
|
|
« Reply #1969 on: December 12, 2022, 03:00:01 PM »
|
|
|
Volvo has two CAN networks. The CEM is connected to both. High speed is 500kbps or 250kbps, and low speed is 125kbps.
|
|
|
|
|
Logged
|
|
|
|
dikidera
Full Member
Karma: +8/-8
Offline
Posts: 149
|
|
« Reply #1970 on: December 12, 2022, 03:11:51 PM »
|
|
|
Volvo has two CAN networks. The CEM is connected to both. High speed is 500kbps or 250kbps, and low speed is 125kbps.
So by setting my speed to either of these lower speeds I can communicate with these modules? |
|
|
|
|
Logged
|
|
|
|
rkam
Full Member
Karma: +4/-0
Offline
Posts: 55
|
|
« Reply #1971 on: December 12, 2022, 03:22:26 PM »
|
|
|
Yes. But they are on different pins.
|
|
|
|
|
Logged
|
|
|
|
dikidera
Full Member
Karma: +8/-8
Offline
Posts: 149
|
|
« Reply #1972 on: December 14, 2022, 02:20:35 AM »
|
|
|
Well, I will have to equip myself with another set of chips for CAN communication. I have also received my replacement ECU. I plan to abandon the plan to enable writing to the external memories without enabling flashing of the main chip, as in my opinion that isn't possible. I believe there is hidden, undocumented functionality inside the SH7055 which cannot be enabled externally. So the plan is to use the standard method with the SBL and/or npkern. My next goal is to figure out how and if at all the checksum differs between Denso and ME7, where it's located etc. Small correction. It's late but I was looking at all the function in the SBL and giving them appropriate names. Look what I found  It looks familiar  So the SBL enables writing/erasing, but something must still trigger the WE/OE pins. It still could be internal SH7055 circuitry. |
|
|
|
« Last Edit: December 14, 2022, 02:17:03 PM by dikidera »
|
Logged
|
|
|
|
s60rawr
Full Member
Karma: +19/-1088
Offline
Posts: 170
|
|
« Reply #1973 on: December 15, 2022, 03:27:47 AM »
|
|
|
2000 v70r
its not perfect... tvub be off etc
|
|
|
|
|
Logged
|
There is a free flash suite in progres
-Karma Sponge |
|
|
dikidera
Full Member
Karma: +8/-8
Offline
Posts: 149
|
|
« Reply #1974 on: December 15, 2022, 03:14:39 PM »
|
|
|
On googling, some people are claiming that Denso ECUs don't need checksum correction, perhaps they don't do a checksum on the data?
|
|
|
|
|
Logged
|
|
|
|
|
prometey1982
|
|
« Reply #1975 on: December 18, 2022, 11:30:14 PM »
|
|
|
Dumps from TF80 and aw55 gearbox.
|
|
|
|
« Last Edit: December 19, 2022, 03:27:54 AM by prometey1982 »
|
Logged
|
|
|
|
dikidera
Full Member
Karma: +8/-8
Offline
Posts: 149
|
|
« Reply #1976 on: December 19, 2022, 01:42:05 PM »
|
|
|
From the dumps(xc90 2.5d is aw55?), execution starts at address 0x1000, but what is at 0x0-0xFFF?
|
|
|
|
|
Logged
|
|
|
|
rlinewiz
Jr. Member
Karma: +12/-1
Offline
Posts: 42
|
|
« Reply #1977 on: December 19, 2022, 08:35:36 PM »
|
|
|
Dumps from TF80 and aw55 gearbox.
pretty interesting bin layout, never seen this before [edit] ha, s-records, interesting |
|
|
|
« Last Edit: December 19, 2022, 08:40:56 PM by rlinewiz »
|
Logged
|
2005 S60R M66-Swapped // Self-tuned @ 22psi
[[forever coding for the OpenMoose project]]
|
|
|
|
prometey1982
|
|
« Reply #1978 on: December 19, 2022, 10:38:53 PM »
|
|
|
2005 S60R Auto, Stock (soon M66 swap)
Swapping to M66 isn't good idea. It's better to swap to TF80 and tweak TCM and ECM. |
|
|
|
|
Logged
|
|
|
|
|
prometey1982
|
|
« Reply #1979 on: December 20, 2022, 01:41:03 AM »
|
|
|
If somebody has SBL for TCM please share it.
|
|
|
|
|
Logged
|
|
|
|
|
