Unfortunately we do not accept new members for free, Now Registration cost 30€, if you are interesting Send Email to [email protected]
Porsche BCM backups, programming and problems
|
23-09-2022, 11:57 AM,
Post: #1
|
||||||||||
|
||||||||||
Porsche BCM backups, programming and problems
Wanted to create a thread where anyone could share and find information about Porsche front and rear BCM modules. Cayenne, Macan, Panamera and others. Backups of MCU memories - D-Flash and P-Flash, what programmers to use and from which to stay away. IMMO/Key/CS related information and how to adapt used BCM and ECU modules to the car. There are a lot of posts around the forums where people are looking for help where from trying to read/unlock/write BCM is dead after. MCU's used in these BCM's is very sensitive (Motorola MC9S12 - 1L15Y, 1N35H, 2M25J, 5M48H) and some programmers when trying to ID/Read/Unlock/Write these MCU's tend to corrupt or erase the memories in these MCU's. From what i have experienced it is the D-flash and Partition configuration that tends crash. I have from scrap Cayenne 2014 4.2 diesel - front and rear BCM modules and both ECU's EDC17CP44 and I also bought used BCM from Macan 2017 to play with. BCM reading/unlocking: Cayenne Front BCM with 5M48H MCU, rear BCM with 2N25J MCU and Macan front BCM with 1N35H MCU. All 3 BCM modules i successfully read with VVDI Prog. I removed the diode, 0 ohm resistor, made the cut to crystal connection and i prefer to desolder the crystal too and 12V power supply to programmer connected. It had no problem reading the backup of Dflash and Pflash. It did the UNLOCK function without problem. From there is started to experiment what could be the reason for corrupting these memories. Using VVDI Prog i used LOCK function to lock back these MCU's where locked byte is 7D (FE for unlocked). I have Autel IM608 with XP400Pro programmer and I tried to use that for reading these BCM's. 2M25J was OK. 5M48H was OK. 1N35H - DEAD. Autel could not do the backup of the 1N35H, it was unsuccessful unlocking the MCU. After that VVDI Prog could not unlock it too because something in that MCU was already corrupted by Autel programmer. Had to use "Force Unlock" with VVDI Prog and it worked but Dflash was already wiped, partition config was wiped and Pflash was seriously corrupted. So i revived that 1N35H memories with what i had backed up before, did the LOCK again and tried again with Autel. Autel killed it again. I don't know about other people experience but mine Autel XP400Pro is a "No GO" fot 1N35H MCU. I am not saying VVDI Prog is the golden tool because some people using VVDI Prog have killed the BCM's. For example i tried to read the 1M35H and 5M48H mcu with VVDI Prog but 12V power supply disconnected - it did not read anything. But it also killed these memories like Autel. Maybe Autel has bad power delivery to MCU where 5M48H tends to survive but 1N35H is way too sensitive and dies. Anyone have experience with UPA programmer(original not Chinese clone)??? Immo/ECU/BCM CS: Since i have both BCM's and ECU from the same car i did some research on IMMO CS information. These are only my findings and I have no idea but maybe it can help to adapt used module to the car for someone using this info. ECU is EDC17CP44 like VAG cars i tried to use VVDI2 to calculate CS from eeprom and flash and it worked. ![[Image: vvdi2-calculated-ecu-cs.sized.png]](https://content33-foto.inbox.lv/albums/m/mriekstins89/23-09-2022/vvdi2-calculated-ecu-cs.sized.png) In front BCM Dflash there are 2 CS. 1 for KEY programming and 1 that is exactly the same as VVDI2 calculated ECU CS. In rear BCM Dflash there are 1 CS that is a MIX from both ECU CS and Key programming CS. CS: 1B EE E3 28 DB 1A 39 7F 04 FA 01 A8 F2 8C E4 F7 - ECU (EDC17CP44) CS calculated with VVDI2 A1 64 65 AE F1 B7 0A 3A 6C EB 56 7E A1 34 92 BD - Front BCM CS for key programming (located in Dflash 0x0021D and 0x0211D) 1B EE E3 28 DB 1A 39 7F 04 FA 01 A8 F2 8C E4 F7 - Front BCM CS for ECU sync (located in Dflash address 0x0022D and 0x0212D) 1B EE E3 28 F1 B7 39 7F 04 FA 56 7E F2 8C E4 F7 - Rear BCM CS (located in Dflash 0x00202 and 0x02402) is a mix where 5th, 6th, 11th and 12th byte are from key programming CS and other bytes are from ECU sync CS I am also including here all backed up front and rear BCM files with Dflash and Pflash from this scrap Cayenne, spare Macan front BCM and some others that i found on forums. 7PP907064GD - front BCM 7PP907279AS - rear BCM 7PP907064KK - front BCM 7PP907064KN - front BCM 7PP907064GA - front BCM
| ||||||||||
