Volvo XC70 2004 instrument cluster software modification

[VolvoXC70]

Hello.

I have a little project going where i want to use a webasto diesel heater outside of the vehicle. For this project i have the webasto itself, a CEM, DIM and a Steering wheel module (SWM). All of these parts are from the same donor car.

So far i have wired everything on a bench and i am able to communicate over CAN with all control modules. I understand that there is probably other ways to accomplish what i am trying to do here with the help of advanced equipment to inject the correct CAN messages in order to get the webasto working and i might look into that later.

My issue now is that with all control modules wired i should in theory be able to start the webasto once its hooked up to diesel and coolant but i keep getting the "brake failure, pull over" warning in the DIM info display which makes it impossible to scroll to the webasto timer settings and direct start function. This is done with the scroll wheel and read button on the turning lights indicator stalk under normal operations.

The only way i see it possible to override this without software modification would be to actually wire a ABS unit into the system but that also means i would have to get all the correct values for the ABS not to trigger any faults which is not feasible for a bench setup.

I have the DIM Eeprom and flash dump read with Carprog. Is it possible to modify the file and delete the brake failure warning? I have attempted something similar before on a different DIM and although i ended up with the same file size (128kb) after i wrote it to the DIM it became unresponsive and it was not possible to either read the new file or write a new one which basically bricked that DIM and it was used for spares. Maybe it was a checksum error?

Can anyone help me out here with some information on how to proceed or maybe even modify the file for me? I have attached both the EEprom and flash file. I have to add that the flash file has the swedish language package, brake failure means "bromsfel" in swedish. I can locate exactly which line of code contains the message if needed.

[robertb1]

Hi there,
Interesting project - looking at my own DIM dump, these messages are not null-terminated.
What exactly did you have in mind when saying "delete the brake failure warning"?
Also whether you patch the DIM code or change the DIM messages, the dump will remain the same length.
I have experimented with changing my DIM messages and there doesn't seem to be a checksum.
/BR

[VolvoXC70]

Hello and thanks for your reply.

What i mean is i want that brake message to not show up even if there is a brake fault because the brake fault message prevents any operation in the left corner info display of the DIM, until the brake fault message have been cleared, which is not possible. So i am looking for any way to accomplish that. I have been thinking about this since my first post realised its of course the CEM that triggers the fault, the DIM only displays it. That opens up more possibilities for either deleting the fault already in the CEM or install some kind of CAN filter on the low speed can between the CEM and DIM, however i do not know how to accomplish that at the moment so for now investigating the DIM possibilities seems to be the best.

The brake fault is not the only one triggered with this bench setup i have, it also triggers airbag warning and sometimes door open warnings. Those warnings are quickly being displayed when ignition/12v is turned on, before the brake fault which like i described is not possible to cancel. The only difference between all of these warnings is that they are all "yellow lamp" warnings while the brake fault is a "red lamp" fault. I am refering to the lamp in the lower center of the DIM which comes on for any reason like the above mentioned or even low washer fluid or a broken light bulb.

So maybe just moving the fault from the list of red faults to yellow would be enough? I will experiment a bit more but i dont really have any more DIMs to brick so i need to be a bit careful. I have the file saved and as far as i know DIMs are not VIN spesific on these cars, only the correct year software is needed. Not sure if the same applies to the SWM as i only have one to test.

[robertb1]

Hello and thanks for your reply.

What i mean is i want that brake message to not show up even if there is a brake fault because the brake fault message prevents any operation in the left corner info display of the DIM, until the brake fault message have been cleared, which is not possible. So i am looking for any way to accomplish that. I have been thinking about this since my first post realised its of course the CEM that triggers the fault, the DIM only displays it. That opens up more possibilities for either deleting the fault already in the CEM or install some kind of CAN filter on the low speed can between the CEM and DIM, however i do not know how to accomplish that at the moment so for now investigating the DIM possibilities seems to be the best.

The brake fault is not the only one triggered with this bench setup i have, it also triggers airbag warning and sometimes door open warnings. Those warnings are quickly being displayed when ignition/12v is turned on, before the brake fault which like i described is not possible to cancel. The only difference between all of these warnings is that they are all "yellow lamp" warnings while the brake fault is a "red lamp" fault. I am refering to the lamp in the lower center of the DIM which comes on for any reason like the above mentioned or even low washer fluid or a broken light bulb.

So maybe just moving the fault from the list of red faults to yellow would be enough? I will experiment a bit more but i dont really have any more DIMs to brick so i need to be a bit careful. I have the file saved and as far as i know DIMs are not VIN spesific on these cars, only the correct year software is needed. Not sure if the same applies to the SWM as i only have one to test.

Hi again,

I have don't have any experience with this message (never had it displayed) but I know where it is in my DIM.
Is it possible to connect the BCM to your bench setup?
If yes and once we know the source of the error, you should be able to fake a working brake system.
Is it perhaps triggered by the lack of brake pressure (sensor 7/129) connecting to the BCM?
The low hydraulic brake fluid sensor (7/4) attaches directly to the DIM and lights up the brake warning light.
I think that preventing the error with the correct module would be faster than trying to intercept it on the CAN bus.

About bricking a DIM, I've never experienced that either (I use Orange5).
If I write an incorrect file to the DIM, I can always erase and try again (using the BDM of the MC9S12 MCU).
Does Carprog not use the BDM mode like Orange5?

Cheers,
/BR

[VolvoXC70]

I think there is a lot of different reasons why the brake warning would come on but the ones you mentioned there could be worth checking out first so i will do that. Unfortunatly the BCM from that car was already gone but i have a few different ones i could try to hook up and see if any of them work.

Carprog reads over OBD with adapter that comes with Carprog.

Update will follow once i have done some more research.

[VolvoXC70]

Small update:

Connecting the "low brake fluid" sensor wire to ground as in wiring diagram only gave the "low brake fluid" message in addition to the "brake fault" one so no luck there. DTCs stored in CEM says no connection to BCM as expected. Also expect loads of errors once its connected. Next steps will be to attempt some software modification to check results and or try to wire a ABS on in the setup.

[robertb1]

Small update:

Connecting the "low brake fluid" sensor wire to ground as in wiring diagram only gave the "low brake fluid" message in addition to the "brake fault" one so no luck there. DTCs stored in CEM says no connection to BCM as expected. Also expect loads of errors once its connected. Next steps will be to attempt some software modification to check results and or try to wire a ABS on in the setup.

OK, I understand - it will be a process of error elimination or a lucky break on the software side of things

As you probably know, you will need a BCM with firmware compatible with your CEM version.
If you don't know what version of BCM is compatible, you could look up your CEM software version information and other Volvo owners could perhaps contribute their BCM version information.
I have a 2006 so it is unlikely that my BCM information would be of help.

My interest in the BCM unit is to make a copy of its firmware so that if ever goes back, I can re-flash a donor unit.
I've archived many modules on my V70 just in case (ECU, CEM, DDM, PDM, UEM, REM, etc.).

/BR

[robertb1]

Meant to say (system won't let me correct):
My interest in the BCM unit is to make a copy of its firmware so that if ever goes BAD, I can re-flash a donor unit.

[VolvoXC70]

Hello again.

After a long day i think ive come to the end of whats possible with the parts i currently have at hand. When i started buying parts for this project the BCM was already sold on that car. I thought that was a red flag as i might need it later but decided to go with it as the donor car was close to my place and i got the parts cheap. Turns out it was a bad plan as the CEM did not match any of the 3 BCMs i had laying around. Luckily i had both a CEM and BCM from a different car i scrapped for parts several years ago and it also had a diesel heater so that software is activated in CEM.

Wired everything and i get ABS-0010/20/30/40 for missing ABS sensors as expected. ABS-0103 pedal position i was able to work out with a 1.5v battery setup but i keep getting other codes like ABS-0074 hydraulic valve faulty signal and ABS-0070 power supply for pump motor faulty signal. ABS-0100 com. fault with ECM pops up intermittently. I believe there was also another one or might have been one of the ones already mentioned that was possibly triggered by having more than 2 ABS sensor faults active. I do not have any ABS sensors available and i believe these are passive ones so i tried making a 1k ohm test cable and hook it up so see if anything happened but no.

I decided to stop there and instead focus on the software part. As mentioned before the plan is to make a cheap setup where its possible to start the diesel heater outside of the car, not just one setup but one for every project so even if i were to get it to work with the BCM that means i would need to find a donor car with a working CEM, BCM, DIM, SWM and diesel heater for every project, at a good price. The physical size of the whole thing is also getting kind of big.

I have started experimenting with the DIM software but had no luck so far. I am able to change the text, no checksum problems as you said but if i remove anything, even just 64 byte, Carprog says wrong file size and will not write the file.

Updates will follow once i have more progress.

[dikidera]

Sorry to bring back the thread with something semi-unrelated, but what tool is there to definitively read and write to the DIM with no risk to brick it? My interest is to modify the language pack and maybe if needed flash + mileage. I think IO terminal can but it seems to be rather expensive and carprog is mentioned but it seems it bricks DIMs?

P2 era cars but specifically by OBD, bench only as last resort. I know SMOK UDHS can do it, but that tool costs several thousands of dollars. Cars S60 00-2010(p2), v70 p2, s80 99-2007 etc.

As for your original question. The firmware needs to be analyzed to see how errors are processed. It's obviously a CAN message being sent with the brake failure message, but the logic is tripped way way before the message is displayed. If you can find which CAN message triggers this, it may be possible to find a byte you can patch out.

Additionally since the chip is that awful motorola-like cpu HC12 or whatever, it uses paging...as such a lot of work is needed to stitch an IDB, that I've never done it either.