Thanks: 10
Likes: 11
Thank you very much for the info and the link, I'll check that out once I find the cause of the problem.Originally Posted by Jon1796
if you haven't tried to read the HOW2's yet i'd suggest you start there is a wealth of info in it and there is an index topic that is seriously well categorized.
Now, a year after, when I've just solved the problem - let me answer to myself:
Yes, the fault I described is a very common fault on Vectra C.
The problem is caused by MC68HC908AZ60 mask 2J74Y processor which has a well known flaw - flash data retention.
Over time some bytes stored in the flash area start to read with error when the temperature is below certain threshold causing watchdog timeouts and seems as the firmware is written such that after 4 restarts caused by the watchdog the processor halts.
There are 2 processors on the PCB - the top one's TX/RX pins are connected to TLE 6255 G (Low Speed CAN Transceiver) and the bottom one's TX/RX pins are connected to TJA 1050 (High speed CAN transceiver).
By heating the processor it can read the instruction opcodes stored in flash without errors but with the time the temperature when the processor works well is higher and higher.
In the beginning when the problem starts it is enough to warm the processor with the finger but after a year of two it can work well only if temperature is above 20°C, then 25°C, then 30°C etc.
The solution:
I desoldered both MC68HC908AZ60 mask 2J74Y processors and then I was reading the data two times at the room temperature then at 60°C then at 80°C and two times cooled down to 5°C.
Since the programmer uses low frequency clock all readings were exactly the same and all were correct. In case of using the same crystal as in the CIM, only readings at high temperatures would be correct or the correct data has to be reconstructed from multiple readings.
Then the same processors could be programmed with the correct data and soldered back, but that is a risk because if the data is read with errors then the original firmware would be destroyed.
That's why I've bought a few "new" 2J74Y processors but all of them had EEPRTCT bit in EENVR2 register programmed as 0 which is one time lock and such processor can't be erased using block erase mode or reprogrammed.
Then I took some old CIM and removed 2J74Y processors, reprogrammed them with the data I read from the original processors, soldered them to the original CIM and the problem was solved.
BTW, to read the processors 12V has to be connected to the IRQ pin before RST pulse and after that 8 security bytes must be sent to unlock reading of flash. If the security bytes are not correct all bytes read from the flash will be 0xad
Security bytes could be found by side channel attack - monitoring the current drawn by the processor when sending the bytes to determine which way the loop for processing the bytes went after comparing the received byte with the bytes stored in flash.
well you didn't mess about finding the problem trouble shooting it and solving it... still had to get the right part from another good working CIM but hey you solved it ( if that was me the moment I had to resort to getting a good working CIM the old one would be in the bin)
Here are the reasons why I didn't/couldn't/ or even wanted to replace the CIM:
1. With Vectra 2002 only old version of XU and XR CIM modules with one airbag connector can be used without modifications or problems after installing them. Later models of CIMs with two airbag connectors that have MC68HC908AZ60 mask 1J35D processors or Infineon processors and a separate EEPROM chip are not easy to use with Vectra 2002 and every working CIM with 2J74Y processors will over time have the same problem with flash data retention.
2. The CIM I got probably wasn't working. I was looking for only the processors but I could remove them from Merdes EZS module or from Audi TT instrument table or from Mercedes Vito Instrument table or from Renault Laguna instrument table or from Renault Espace instrument table etc. as well. Here is the same problem with 2J74Y on Mercedes EZS module when you can't turn the key if the processor is not warm but as soon as you heat it with the finger it works well:
https://youtu.be/8JTbSrgwbWg
Here is the same problem with 2J74Y on Renault Espace instrument table, again - heating the chip with the finger is enoung for the processor to start working:
https://youtu.be/Jw6aOjJuzuc
In both cases, after some time it wouldn't be enough to heat the processor with the finger, later on the processor would have to be heated much more using a hair dryer or a heat gun and when the processor wouldn't work at even 105°C then the only way of repairing it is using low frequency crystal and reading the processor while heating it.
3. To repair the CIM you don't have to change the 2J74Y processors, it is enough to just reprogram it with the same (but correct) data it already has. Since it is not possible to buy the new MC68HC908AZ60 mask 2J74Y processor which doesn't have EEPRTCT bit in EENVR2 register locked and the only way of getting those processors is to remove it from some car electronics - it is not easy to find a working XU or XR CIM. I searched over a few hundreds of listings and I found only two CIMs which I could use - one from Croatia and one from Lithuania. I bought both of them but the one from Lithuania had 1J35D processor which have ROM instead of flash.
4. Now that I read the processors I have the hex dumps which I could use to repair the CIM in the future by using any 2J74Y processor from any car.
5. As soon as I saw the needles drop every exactly 45 seconds and after exactly 4 watchdog timer restarts the processor halts - I knew the problem is connected to the firmware/processor and I wanted to disassemble the code to see if my assumptions are correct. I will disassemble the firmwares as soon as I get time. I'd like to see if there is some routine called every exactly 45 seconds or if the watchdog timer is configured to expire after not being reset for that very amount of time. Moreover, I will read the flash from the original 2J74Y processors by using a 16 MHz crystal when there will be the same reading errors as when the processor was installed in the CIM. Then I will see which instructions were decoded with errors and I will know which of the two processors was not working correct.
6. I don't have the equipment to reprogram the ECU, REC, BCM, DDM, PDM and REC which must be reprogrammed after changing the CIM and I didn't want to risk not being able to use the original keys after installing a new CIM. In this video someone who apparently knows what he is doing couldn't program the original keys after installing a new CIM:
https://youtu.be/ShVxLdL_8lM
However, in this video, the original key worked even after installing the CIM which can't be used with the 2002. and 2003. Vectra:
https://youtu.be/8997_tIXXsc
7. I wanted to solve the problem with as few modifications as possible. By reprogramming the processors with the very same firmware I didn't have to reset or program any other module via OBD nor to reprogram the EEPROM area of the processor.
8. I've never worked with cars before but I am embedded HW&FW designer and I was interested in saving the existing hardware - not in replacing it. Now I can repair and save any CIM which has the same problem even without replacing the processors and there are a lot of such non working CIMs that could still be repaired.
Aha so you found a way to make some money... now as i said for me it's not something i would do as a service for others so for me it would be a replacement and done... and if i was to fix it it would only be so that i got a spare part for my own use... ps i got a 03 vectra but mine is a vectra C that has the 2 stage airbag CIM connector... But that might be because Vauxhall didn't make them here with a single stage airbag so I got the newer model CIM.
I will remember that there is someone that knows how to solve it though when i run into a problem like yours down the line.
I didn't think of making money when I was trying to repair my car but now that you said that... :-) Indeed, I really could (now, after a year of research) repair someone else's CIM or some car computer containing MC68HC908AZ60 mask 2J74Y. But that is not what I am doing, I design hardware not repair it.
Your CIM probably has MC68HC908AZ60 mask 1J35D processors which are not susceptible to the same problem.
I noticed some CIM modules have angle sensor and mine has a magnet running above two hall sensors. Unfortunately I broke the plastic clips (which are part of the ribbon cable housing) holding the ring with the magnet and I am now looking for a way to move the ribbon cable housing from another CIM but I still can't remove it. I am not sure if that magnet is used only to switch off the turn signals when rotating the steering wheel or the firmware is using the data to calculete the speed of the rotation of the steering wheel to adjust the strength of the servo as well but everything works even without the magnet.
BTW, what is the name of that part that holds the ribbon cable, a spindle or something?
northpole liked this post
I have no idea what it is called maybe someone on the forum like @plasma can tell you what it is called... I did mention him so he will receive a notice, he'll chime in soon enough.
Chupo_cro thanked for this post
There are currently 1 users browsing this thread. (0 members and 1 guests)
Posting Permissions
Reply With Quote
Bookmarks