Vectra C - CIM works well only when PCB heated up

[chupocro]

Hi all, my first post here.

I have Opel Vectra C 2.0 2002 (motor Y 20 DTH) and am trying to diagnose the problem with the CIM module for quite a while. The problem goes away when I heat up the CIM's module PCB (or just drive for a while) and I did locate the area where the PCB has to be heated up for the problem to go away. I've marked the area which has to be heated up in the pictures.

Before I describe the details I'd like to ask if anyone could help me with any information about:

- The CIM module main connector pinout. I could't find that data in TIS.
- A way to backup the firmware and the data (flash + EEPROM) from both MC68HC908AZ60 microcontrollers (no separate EEPROM chip on this version of CIM). I'd like to backup these in case I'll have to replace the processors.
- The right way of removing the ICs. I've been working with SMD for years but this PCB has some kind of conformal coating. I've been told it could be removed with Abro Paint Remover spray but seems as the ICs are glued at the bottom.
- Which task is performed by the CIM's fimware every exactly 45 seconds (I know that is a hard question but in case someone disassembled the firmware :-) ).

Detailed description:

When CIM module is cold one of the microcontrollers restarts every exactly 45 seconds and after the fourth restart the firmare disables the HIGH <--> LOW speed CAN interface.

When the microcontroller restarts the RPM and speed indicators drop to zero for a moment and there is a warning sound if the seat belt is not fastened as when the ignition is on for the first time and ESP + ABS lights blink for a moment. After the fourth restart (after 3 minutes) when HIGH to LOW speed CAN interface turns off the communication with the instrument table stops (since it is on the low speed CAN bus) all the indicators drop to zero and alternator + ABS warnings light up.

The error stored by CIM is "B1006 - CAN-Bus Low Speed Controller Circuit Malfunction".

All other modules store the error "U2139 - CAN-Bus No Communication with CIM (Steering Column Module)".

After 15 or 30 minutes of driving (depending on temperature), especially if heating is on, everything starts to work correctly.

After CIM module disables the HIGH to LOW speed CAN interface all other modules on the low speed CAN bus can still communicate between each other without errors. The "only" problem is after the fourth restart CIM doesn't anymore send the data towards the instrument table and it doesn't send the data about pressing the buttons on the steering wheel, pressing the horn and using the turn signal and wiper handles. This YouTube video (https://youtu.be/eTwmwUqL1TA) shows exactly the same problem.

I checked the CAN signals with the oscilloscope and they are perfect.

I tried to heat up different areas of the PCB to locate the cause and seems as everything works well when I heat up the area where is TLE 6255 Single Wire CAN-Transceiver IC (which is used by the CIM for communication with the low speed CAN bus).

I am aware the ground planes might spread the heat to some other location and heat up some other element but at the moment I have to apply the least heat when heating the area where the TLE 6255 is - regardless of the side of the PCB I apply the heat to.

I reflowed both microcontrollers (just in case) and TLE 6255 but seems as it wasn't a dry solder joint on these ICs.

I will order a new TLE 6255 to see if the problem is that IC and I'll replace the 220 µF SMD capacitor above the TLE which is connected between +12 V going to TLE and GND.

The problem is I can't measure voltages with the ignition on because the PCB has to be inserted plugged into the key lock and the measuring points are on the other side.

In the meantime, I would be grateful for any information about the CIM (pinout, backing up the firmware, ...) and/or any advice about repairing it.

[castin]

Try wood stick and on car pull single part or pcb area. Check pins and connector, resolder cold point.

[chupocro]

Try wood stick and on car pull single part or pcb area. Check pins and connector, resolder cold point.

Thank you for your reply!

Unfortunately there are a few reasons why I couldn't use that method:

- After making some changes (heating up) I can test the PCB only by turning the ignition on and waiting for 45 seconds to see if there would be a warning sound meaning there was restart. The only way to turn on the ignition is to mount the PCB into the housing as in the first picture CIM_back_where_to_heat.jpg because the PCB has to be plugged into the key lock pins. When the PCB is inserted into the housing it can't be bent because of the standoffs.
- The PCB should be bent for 45 seconds to test if it works. After the fourh restart of the CIM the only way to restart low speed CAN communication is to turn off the ignition.
- I can't see the other side of the PCB when testing it. I was removing the PCB, heating it up and the quickly insertinge the PCB back into the housing, plugging the main connector and turning on the ignition to see if the problem goes away. I repeated that many times to determine the location that has to be heated up.

Maybe I did'n understand correctly what did you mean by "pull single part using the wood stick". Did you mean to insert the toothpick under the chip and to use it as a lever to pull the chip up?

The problem is TLE 6255 is on the other side of the PCB and I can't reach it while the ignition is on :-/

If I could reach the other side of the PCB while the ignition is on then I could even measure the TLE's voltages and check them witht the oscilloscope.

I've already checked the pins and the connectors many times and I resoldered the main connector, the processors and TLE 6255. I can heat up the connectors and the pins for 5 minutes and that doesn't help but when I heat up the marked aread for just 30 seconds the problem goes away. The only connectors connected while testing the PCB are: the main connector which has a lock, the 7 pin connector going from the housing into the white header which is angled and two pins going from the key lock into the blue header. The other connectors are for the airbag and the handles but I don't connect these when testing.

[castin]

Remove the varnish from the elements near the marked area and resolder the elements, resistor ladders.

[chupocro]

Remove the varnish from the elements near the marked area and resolder the elements, resistor ladders.


I'll try that this weekend, thank you!

[elservis]

If mcu is motorola 2J74Y there is problem.

[chupocro]

If mcu is motorola 2J74Y there is problem.

Yes, you are right. I found some old posts describing the well known problem with MC68HC908AZ60 mask 2J74Y on many cars (Opel, Mercedes, Audi, Renault, ...) when everything works well only above some temperature. With the time there are flash reading errors below certain temperature and when the cpu reads wrong instruction op-code the firmware starts executing unpredictably causing reset by the watchdog timer. After some more time the temperature when eveything works well is higer and higher until the µC doesn't work well even when heated by the hot air.

My plan is to read the original flashes and EEPROMs while heating the µCs using iProg and to then reflash the new µCs with the same firmware. I know I could reflash the same µCs again but I'd rather keep the original microronctrolers. I'd like to avoid replacing the CIM and reprogramming ECU, BCM, UEC, REC, DDM and PDM.

Seems as everytime when reading the flash there will be some erroneous bits - even if I'll be heating the µC. But my plan is to read it many times and to write a program to examine every byte in every .hex file and to then generate one .hex that is going to be correct.

I've read through the MC68HC908AZ60's datasheet, seems as the protected flash and EEPROM could be read by writing the firmware for reading the flash and EEPROM using monitor mode to the RAM, then write the starting address of the firmware on the stack and to then execute RUN command. I think that's the way programmers can read the "protected" MC68HC908AZ60s. Or the firmware uploaded to the RAM could read only the security bytes and send it over PTA0.

I have another CIM with the same numbers but the µC is 1J35D which has ROM instead of flash and the CIM has angle sensor instead of two hall sensors. I am using that CIM to practice desoldering the µC but I still couldn't remove it. I removed many ICs with hot air or hot air + solder in less than a minute but I couldn't remove this one even when heating it for 10 minutes after covering all pins with the solder. Seems as the chip is glued at the bottom.

Do you maybe know which 2J74Y is responsible for high <--> low speed CAN interfacing? Since both µCs are approximately in the same place (just on the other sides of the PCB) I can't be 100% sure which one is causing the problem.

Or I might read the RST signal with the oscilloscope to check which µC gets reset by the watchdog.

[drz]

Don't waste your time. Find pin of new cim and program with cars pin and all ok.

[chupocro]

Don't waste your time. Find pin of new cim and program with cars pin and all ok.


To find the PIN of new CIM I have to remove the MC68HC908AZ60 too and then after resetting the new CIM and programming it with the car's PIN I'd have to reset ECU, BCM, UEC, REC, DDM and PDM which could go wrong.

It isn't much more work to read the original MC68HC908AZ60 a few (while heating it) in which case I don't have to reprogram ECU, BCM, UEC, REC, DDM and PDM.

In both cases I have to remove, read and resolder the µC.

But I am still not 100% sure which µC is the problem - the one at the top or the one at the bottom :-/

[chupocro]

After more than a year I finally solved the problem :-)

I programmed 2 processors which I removed from some old CIM with the data from the original processors and soldered them to the original CIM.

Here are the pictures:

https://www.digital-kaos.co.uk/forums/showthread.php/1014063-2J74Y-works-only-when-warm-but-programmer-reads-the-same-data-warm-or-cold?p=4519334&viewfull=1#post4519334