VIN and Flash Correction on 2008 Elantra
I got a call today from a customer that had purchased a second hand PCM for an Hyundai Elantra. The customer discussed the replacement with me. I suggested that the engine should start but the VIN would not be correct. This is an issue in areas with Emissions testing. If the VIN does not match the shop doing the test could get flagged for cleanpiping or worse could end up registering a wrecking yard vehicle instead of the one in the bay. Unfortunately, I am not aware of any scan tool that will re-write the VIN on KIA or Hyundai vehicles. I told the customer I would need to get the donor and the original PCM so I could work my magic.
Tools Needed: 12VDC Power Supply, OBD Breakout Box, Off Board Cables, 25 Watt Soldering Iron with Small Point, Hot Air Rework Station, Rosin Flux, Screwdriver, Razor Blade, J2534 Pass-Through, BitBox Software, Sealer I am sure you can improvise but these are what I have found to be effective after some trial and error.
The PCM is a Siemens SIM2K-47. I looked all over online and could not find much information on it. I went into the wiring diagrams and was able to locate the power, ground and communication lines. From there, I hooked up my laptop with a pass-through device to the PCM with a program called BitBox. Bitbox was able to read the FLASH (Maps and Calibration Files) but not the EEPROM. The EEPROM is where the VIN and other vehicle specific information is stored. I tried some of the other software but nothing could get into the EEPROM files. This is common as most of this software is developed to work with custom tuning not reworking ECUs.
I decided to go old school and remove the memory chip from the original PCM and transplant it. After some experimentation, it was discovered that the AM29F400BB Memory chip on top of the board contained the EEPROM information and the one on the bottom contained the FLASH files. To deal with the flash, I burned the original FLASH back to the PCM over the CAN network. The memory was then heated up with a hot air rework station, removed and placed in position on the donor board. This was done after removing and preparing the donor.
When attempting this process be aware that the metal case cover is glued on with a sticky sealer that is much like the old windshield tape. I found by heating it up, it pried up much easier. There are metal tabs that need to be pulled away from the Aluminum case. I used a screwdriver for this. Once the sealer is heated and the tabs pulled away, the metal cover can come off. After lifting the cover, use a razor blade to cut the strands of sealer. Be aware the the board is close to the edge and has components that can be easily damaged.
After the cover is off you can see the memory chip on the board. Be sure to use best practices when heating up the chip. Too much heat will kill it. Also be aware that other components solder will melt and you can knock them out of place. Once the chip is off the board I like to flux up my soldering iron and reflow the pads while they are exposed. Try not to create peaks as this will lift the chip and create problems while soldering the replacement back down. After removing the chips from both PCMs, install the original chip on the donor PCM. You can then write the original flash to the donor ECU. You should now have a donor PCM that has identical programming. I would suggest adding a thin coat of sealer all around the case to make sure water can't get in. I use sensor safe silicone. It is not the same as what is in there but it will fill the gaps.
To make sure it all went well, use a scan tool to examine the VIN and make sure it matches the original. The process can take several hours so make sure your customer is ready to pay for your time. It still saves a bucket of money over buying a new PCM.
Be aware that there are a plethora of PCMs out there. This method works on this PCM. Different software works with different PCMs. There is no single solution out there that will get into everything. If this is something that you want to do realize that the payback for the tools and software may never come. As mentioned in a previous article, there are some PCMs that nobody bothered to develop tuning software for. I see that there is at least one company out there that specializes in correcting VINs on Hyundai and KIA PCMs. I am sure they have an easier solution than mine.
Mike, Great work! I mean outstanding. I have one in my garage right now and cant wait to crack it open and go exploring. Used Hyundai/Kia PCM has always been a bit of an issue because of the VIN issue. Talking to a Hyundai field engineer a couple of years back he told me at the regional distribution centers they have a machine that can virginize the VIN on PCM's that were sent back from
In thinking about it some more I may be incorrect on the memory chips. The one on the top in fact has the VIN information. I wonder if the chip on the bottom is for transmission function? Some PCMs like the BMW MS43 only allow access to the MAPS and the EEPROM portion of the chip is protected. It is not in reality an EEPROM but a section of the memory that is off limits without the right key to
Mike, Where do you get your off-board cables, or do you just custom make them? Bob
I made the cables. If you can come up with the pigtails from wrecking yards, they are the best to work with. Most yards won't cut the looms for me so I use single wires most of the time. For the small pins you can use Ardurino cables and solder them to banana plugs. I purchased banana plugs that can be stacked. I then soldered wires to them. ebay.com/itm/40X-Dupont… For the
Thanks mike, I'm going to check out the audrino cables.
Sometimes the processor has the eprom memory built in. I don't mess with them. The chip you swapped is a 42 pin eprom. That is the reason it is good to copy it to the laptop, this way you could see the actual Vin number in ASCII format. I don't like to change the Vin number in the chip because a few times it changed the size of the file and then it gets to complicated for me. File size has to
If you don't need the old one it's a lot faster to swap it. I have a Andromedia Research labs eprom programming system. The one thing I always do just in case is backup the data from the eprom on to my laptop. If something goes wrong I could always save myself. eproms can take a lot of punishment. I remove the one below was floating in the floor of a older Porsche. Backed it up and installed old
Nicholas, Cool recovery. I have a few programmers I use. I just ordered a converter for these chips. I was hoping for a chip clip for this one but it must be hard to find.
I don't have a clip for that chip. I always take it off the board, sometimes reading or flashing a chip while connected to the board can cause damage (You have to know which pins to desolder). I have a flash emprom adapter for that chip that plugs into my programmer. I am not a expert at this, I just taught myself how to copy ,erase and transfer the data. But it saved the day for me many times…
That's some seriously slick work! My dad could solder like that. Not me. Although with a brand new tip I am ten times better than the second time I use it.
I forgot to add floodlights and magnifiers to the list. With them it is much easier.
Thanks for the post Mike. Great work and really impressive fix. I'm curious about the breakout box in the first picture. Homemade? I noticed the switches, buttons and extra banana jacks on the right side. I'd love to learn more.
Hi Matthew, I put together the breakout box. I wish I had a CNC machine so everything were perfect but it works. The 16 (OBDII) terminals are straightforward. The rocker switches are for Battery, Switched Power and 3.3VDC. The momentary switches are used when putting ECUs into boot mode. The three Green plugs in a triangle are tied through 1K resistors to ground. The single yellow through 1K
Michael, It seems that we both are moving on the same channels of curiosity on such cases. I've added you on my LinkedIn account. I am quite curious opening a discussion with you. Send me a message when you can.
Hi Mike, I know it's been 3 years since you wrote this case study but if you are still there, I would like your expert opinion on this one. Like your case study, I am in the same situation now. My daughters 2008 Hyundai Elantra SE 2.0L A/T is having intermittent P0760 dtc. Shift Solenoid "C" problem. Shift solenoid "C" test good with 3.5 ohm resistance measured at the TCM connector. Solenoid…
Roberto, This one can be done by swapping the flash memory chips or using VF2 or KTAG / KESS3. The AM29f400 should be the Flash Chip. There is one for the Engine and one for the Transmission. The Engine one has the VIN. I do not remember which side of the board the one for the Engine is on. Nowadays, I use the above mentioned tools to do the job.
Hi Mike, Thanks for the quick reply. I don't have the VF2 or KTAG / KESS3. I will probably just bring the PCM to a nearby electronics repair shop and have them swap the AM29F400BB flash chip. If not I will just probably buy one of those Hot Air Rework Station sold on Ebay. I will let my daughter drive her Hyundai until the end of this month. I no problems come up, I will then proceed with the…