[JagM]

Clonning issue - Jaguar / Land Rover BCM HPLA-14F041-BH

I copied the whole content of SPC5746, SPC5747, and 95128 eeprom, from a faulty donnor BCM [1] to a second-hand BCM [2], but after fitting BCM [2] to the car, there is no ignition, and the Pathfinder can't communicate with the car. The BCM [1] is still working in the car (despite its other fault).

I restored the original content of the BCM [2] (I did a backup), but now it doesn't communicate with Pathfinder as it did before.

I also noticed that the BCM [2] (now not working) keeps modifying the content of the SPC5748 SM-FLASH (original or copied from Donnor). It deletes a number of VIN records and changes some other data.

So my question is: Is copying the whole content of the SPC5746, SPC5747, and 95128 eeprom not enough to make a workable clone? Is there something else on the BCM PCB that needs to be modified?

[sixcode]

what tool you did use for reading mcu's?

and what did you read in these?

[JagM]

what tool you did use for reading mcu's?

and what did you read in these?

IIv'e used VVDI PROG for MCU's, and XGecu T56 for eeprom.

MCU content:

• HSMCODE
  
• HSMDATA
  
• SM-FLASH
  
• LARGE-FLASH
  

[sixcode]

what is the GMW folder?
did you buy exact same donor bcm?

[JagM]

The JLR BCM units from ~2016 contain both BCM (Body Control) and GWM (Gateway) modules in a single box.

The SPC5748 takes on GWM functions, and the SPC5746 is a BCM.

The source and donnor modules differ in the last letter (G/H), but in the JLR, this is the indicator of the FW version loaded into brand new modules and is owerwritten by SDD/Pathfinder during module replacement/fitment anyway.

[sixcode]

for bcm and GMW your missing UTEST (Small Hardware Security Module Code Block 16KB), BAF is OTP so no writing for that one

[JagM]

I get an error when I try to read the UTEST memory (on working and non-working devices).

Also, it looks like the UTEST is OTP memory (according to NXP).

It seems that the UTEST flash read protection is set.

[sixcode]

BAF is otp, UTEST not, try xprog ori

[JagM]

That is confusing then. The MCU User manual states:

Code:

4.2 UTEST flash memory
The MPC5746R UTEST memory allocation is shown in Figure 5 below. UTEST memory for the
MPC5746R device is one time programmable (OTP) memory. There are two basic types of regions in
UTEST flash memory:
• Areas specifically written during factory test that contain a combination of calibration and default
data
• Areas allocated for DCF records (as discussed in the previous section) and other user programmed
data
Because UTEST is OTP memory, program operations to this area are simply “over programmed”; there is
no erase allowed. Note in Figure 4 that a new DCR record is added by simply overwriting (over
programming) the existing UTEST DCF record area. Additional details about programming DCF records
are covered in Section 4.4.

If the UTEST can only be "over programmed" (can't be erased), then a direct copy from a different MCU is obviously not possible.

Also, the description for the xprog software auth, says:

Code:

Supported devices:

    xPC5741/42/43/44P DATA_FLASH, CODE_FLASH, UTEST
    xPC5746C/G CODE_FLASH, HSM_DATA, HSM_CODE
    xPC5747C/G CODE_FLASH, HSM_DATA, HSM_CODE
    xPC5748C/G CODE_FLASH, HSM_DATA, HSM_CODE
    xPC5777C EEPROM, CODE FLASH, UTEST, CSE
    xPC5777M CODE_FLASH, DATA_FLASH, HSM_DATA, HSM_CODE, UTest block, BAF
    Range Rover 2017 BCM SPC5748C + SPC5746C
    VOLVO XC60 2018 CEM SPC5748G

So, no UTEST modification for xPC5746C / xPC5748C devices...

The question is, is the UTEST modification necessary during clonning ?

[diag06]

...............