VVDI Prog vs Autel XP400 Read and Unlock Porsche BCM
Information: what programmers to use and from which to stay away when doing Porsche front and rear BCM modules on Cayenne, Macan, Panamera and others.
How to back up MCU memories – D-Flash and P-Flash, read IMMO/Key/CS related information and how to adapt used BCM and ECU modules to the car.
When you are trying to read/unlock/write BCM is dead after.
MCU’s used in these BCM’s is very sensitive (Motorola MC9S12 – 1L15Y, 1N35H, 2M25J, 5M48H)
and some programmers when trying to ID/Read/Unlock/Write these MCU’s tend to corrupt or erase the memories in these MCU’s.
From what we have experienced it is the D-flash and Partition configuration that tends crash.
Here’s the user working experience:
“I have from scrap Cayenne 2014 4.2 diesel – front and rear BCM modules and both ECU’s EDC17CP44
and I also bought used BCM from Macan 2017 to play with.
BCM reading/unlocking:
Cayenne Front BCM with 5M48H MCU, rear BCM with 2N25J MCU and Macan front BCM with 1N35H MCU.
All 3 BCM modules i successfully read with Xhorse VVDI Prog. I removed the diode, 0 ohm resistor,
made the cut to crystal connection and i prefer to desolder the crystal too and 12V power supply to programmer connected.
It had no problem reading the backup of Dflash and Pflash. It did the UNLOCK function without problem.
From there is started to experiment what could be the reason for corrupting these memories.
Using VVDI Prog i used LOCK function to lock back these MCU’s where locked byte is 7D (FE for unlocked).
I have Autel IM608 with XP400Pro programmer and I tried to use that for reading these BCM’s. 2M25J was OK. 5M48H was OK. 1N35H – DEAD.
Autel could not do the backup of the 1N35H, it was unsuccessful unlocking the MCU. After that VVDI Prog could not unlock it too because something in that MCU was already corrupted by Autel programmer.
Had to use “Force Unlock” with VVDI Prog and it worked but Dflash was already wiped, partition config was wiped and Pflash was seriously corrupted.
So i revived that 1N35H memories with what i had backed up before, did the LOCK again and tried again with Autel.
Autel killed it again. I don’t know about other people experience but mine Autel XP400Pro is a “No GO” fot 1N35H MCU.
I am not saying VVDI Prog is the golden tool because some people using VVDI Prog have killed the BCM’s.
For example i tried to read the 1M35H and 5M48H mcu with VVDI Prog but 12V power supply disconnected – it did not read anything. But it also killed these memories like Autel.
Maybe Autel has bad power delivery to MCU where 5M48H tends to survive but 1N35H is way too sensitive and dies.
Immo/ECU/BCM CS:
Since i have both BCM’s and ECU from the same car i did some research on IMMO CS information.
These are only my findings and I have no idea but maybe it can help to adapt used module to the car for someone using this info.
ECU is EDC17CP44 like VAG cars i tried to use VVDI2 to calculate CS from eeprom and flash and it worked.
.jpg)
In front BCM Dflash there are 2 CS. 1 for KEY programming and 1 that is exactly the same as VVDI2 calculated ECU CS.
In rear BCM Dflash there are 1 CS that is a MIX from both ECU CS and Key programming CS.
CS:
1B EE E3 28 DB 1A 39 7F 04 FA 01 A8 F2 8C E4 F7 – ECU (EDC17CP44) CS calculated with VVDI2 software
A1 64 65 AE F1 B7 0A 3A 6C EB 56 7E A1 34 92 BD – Front BCM CS for key programming (located in Dflash 0x0021D and 0x0211D)
1B EE E3 28 DB 1A 39 7F 04 FA 01 A8 F2 8C E4 F7 – Front BCM CS for ECU sync (located in Dflash address 0x0022D and 0x0212D)
1B EE E3 28 F1 B7 39 7F 04 FA 56 7E F2 8C E4 F7 – Rear BCM CS (located in Dflash 0x00202 and 0x02402) is a mix
where 5th, 6th, 11th and 12th byte are from key programming CS and other bytes are from ECU sync CS
