dikidera
Full Member
Karma: +10/-8
 Offline
Posts: 152
|
 |
« Reply #1950 on: December 12, 2022, 07:59:38 AM »
|
|
|
Is the A7 command the same as B4 in ECM, but A7 for TCM?
|
|
|
|
|
Logged
|
|
|
|
|
prometey1982
|
|
« Reply #1951 on: December 12, 2022, 08:15:04 AM »
|
|
|
Is the A7 command the same as B4 in ECM, but A7 for TCM?
No, it's common command. Here is command for ECM: 7A A7 FF FF FF 01 01 But Alexander which have great experience for Denso ECUs told me that 0FFFFE CAN message doesn't processed inside Denso ECM for almost all commands. I'll check what CAN message is generated for Denso ECM for A7 command. May be there is different CAN id is generated for this ECU type. By the way if you want commercial solution of your problem then Alexander is best person for this. |
|
|
|
|
Logged
|
|
|
|
dikidera
Full Member
Karma: +10/-8
Offline
Posts: 152
|
|
« Reply #1952 on: December 12, 2022, 08:19:33 AM »
|
|
|
No, it's common command. Here is command for ECM:
7A A7 FF FF FF 01 01
But Alexander which have great experience for Denso ECUs told me that 0FFFFE CAN message doesn't processed inside Denso ECM for almost all commands. I'll check what CAN message is generated for Denso ECM for A7 command. May be there is different CAN id is generated for this ECU type.
By the way if you want commercial solution of your problem then Alexander is best person for this.
I had bench ECU, whenever I did 0x7A<command> it all gets executed there. But this was bootloader commands. However there is also a mysterious chip next to the SH7055 which I have no idea what it is, and only a few russians know what it does. Going down to the car to test my VIDA proxy. Excited but also well prepared for various bugs. Well first bug was..my mobile hotspot network had an addition space inserted in the name, and I had configured the rpi to connect to the network manually, and I wondered why it wasn't connecting. now back to the car I go. Ok, so here is what happened. I plugged in the cable, set up everything and could see the CAN bus communication going on, however!!! After sending command 0xFF86000000000000, the whole car restarts, this unfortunately stops power to my RPI, restarting it as well. And the only thing that can do this is the CEM, so perhaps the CEM doesn't like this command? |
|
|
|
« Last Edit: December 12, 2022, 11:09:42 AM by dikidera »
|
Logged
|
|
|
|
rkam
Full Member
Karma: +4/-0
Offline
Posts: 56
|
|
« Reply #1953 on: December 12, 2022, 11:34:01 AM »
|
|
|
The FF in FF 86 means you are sending the command 86 to enter programming mode to all (FF) controllers.
This is normal when you are going to program a controller, because you want the complete car to go quiet.
My 7055 Denso can read memory with the A7 command in the area 6000 to DFFF.
|
|
|
|
|
Logged
|
|
|
|
dikidera
Full Member
Karma: +10/-8
Offline
Posts: 152
|
|
« Reply #1954 on: December 12, 2022, 12:04:37 PM »
|
|
|
The FF in FF 86 means you are sending the command 86 to enter programming mode to all (FF) controllers.
This is normal when you are going to program a controller, because you want the complete car to go quiet.
My 7055 Denso can read memory with the A7 command in the area 6000 to DFFF.
I think I see what you mean. So if I do 7A(7a being the ECM)86, then only this particular module will enter this programming mode? But yes, the whole car should be quiet, as far as I know. But..what happens instead is, the CEM resets the whole car, and we're back to the shouting CAN bus. I must be missing something then? Or maybe I am not missing anything and just need to make sure my RPI is powered at all times, which I will of course. |
|
|
|
« Last Edit: December 12, 2022, 12:16:06 PM by dikidera »
|
Logged
|
|
|
|
rkam
Full Member
Karma: +4/-0
Offline
Posts: 56
|
|
« Reply #1955 on: December 12, 2022, 01:28:16 PM »
|
|
|
You should make sure that all controllers on both high speed and low speed network is in programming mode if you want to program any controller in the car.
I'm sending FF 86 messages on both channels with 5ms interval for a duration of 4 seconds.
|
|
|
|
|
Logged
|
|
|
|
dikidera
Full Member
Karma: +10/-8
Offline
Posts: 152
|
|
« Reply #1956 on: December 12, 2022, 01:33:41 PM »
|
|
|
You should make sure that all controllers on both high speed and low speed network is in programming mode if you want to program any controller in the car.
I'm sending FF 86 messages on both channels with 5ms interval for a duration of 4 seconds.
I currently have no concept of high-speed low speed and for J2534, channels are abstract concepts. All I've read so far has shown that canbus operates at one bitrate. And the HIGH/LOW signals are just differential signals and nothing more. Perhaps you meant LINBUS, in which case I have no transceiver for that bus. |
|
|
|
« Last Edit: December 12, 2022, 01:46:03 PM by dikidera »
|
Logged
|
|
|
|
rkam
Full Member
Karma: +4/-0
Offline
Posts: 56
|
|
« Reply #1957 on: December 12, 2022, 03:00:01 PM »
|
|
|
Volvo has two CAN networks. The CEM is connected to both. High speed is 500kbps or 250kbps, and low speed is 125kbps.
|
|
|
|
|
Logged
|
|
|
|
dikidera
Full Member
Karma: +10/-8
Offline
Posts: 152
|
|
« Reply #1958 on: December 12, 2022, 03:11:51 PM »
|
|
|
Volvo has two CAN networks. The CEM is connected to both. High speed is 500kbps or 250kbps, and low speed is 125kbps.
So by setting my speed to either of these lower speeds I can communicate with these modules? |
|
|
|
|
Logged
|
|
|
|
rkam
Full Member
Karma: +4/-0
Offline
Posts: 56
|
|
« Reply #1959 on: December 12, 2022, 03:22:26 PM »
|
|
|
Yes. But they are on different pins.
|
|
|
|
|
Logged
|
|
|
|
dikidera
Full Member
Karma: +10/-8
Offline
Posts: 152
|
|
« Reply #1960 on: December 14, 2022, 02:20:35 AM »
|
|
|
Well, I will have to equip myself with another set of chips for CAN communication. I have also received my replacement ECU. I plan to abandon the plan to enable writing to the external memories without enabling flashing of the main chip, as in my opinion that isn't possible. I believe there is hidden, undocumented functionality inside the SH7055 which cannot be enabled externally. So the plan is to use the standard method with the SBL and/or npkern. My next goal is to figure out how and if at all the checksum differs between Denso and ME7, where it's located etc. Small correction. It's late but I was looking at all the function in the SBL and giving them appropriate names. Look what I found  It looks familiar  So the SBL enables writing/erasing, but something must still trigger the WE/OE pins. It still could be internal SH7055 circuitry. |
|
|
|
« Last Edit: December 14, 2022, 02:17:03 PM by dikidera »
|
Logged
|
|
|
|
|
s60rawr
|
|
« Reply #1961 on: December 15, 2022, 03:27:47 AM »
|
|
|
2000 v70r
its not perfect... tvub be off etc
|
|
|
|
|
Logged
|
There is a free flash suite in progres
http://www.openmoose.net/blog/?page=renatus #1 Nefmoto -Karma Sponge! |
|
|
dikidera
Full Member
Karma: +10/-8
Offline
Posts: 152
|
|
« Reply #1962 on: December 15, 2022, 03:14:39 PM »
|
|
|
On googling, some people are claiming that Denso ECUs don't need checksum correction, perhaps they don't do a checksum on the data?
|
|
|
|
|
Logged
|
|
|
|
|
prometey1982
|
|
« Reply #1963 on: December 18, 2022, 11:30:14 PM »
|
|
|
Dumps from TF80 and aw55 gearbox.
|
|
|
|
« Last Edit: December 19, 2022, 03:27:54 AM by prometey1982 »
|
Logged
|
|
|
|
dikidera
Full Member
Karma: +10/-8
Offline
Posts: 152
|
|
« Reply #1964 on: December 19, 2022, 01:42:05 PM »
|
|
|
From the dumps(xc90 2.5d is aw55?), execution starts at address 0x1000, but what is at 0x0-0xFFF?
|
|
|
|
|
Logged
|
|
|
|
|
