Canbus wiring loom

[pug_ham 244 3 Cars]

As I'm breaking my written off Xsara VTS I've decided to use the engine, loom & ecu in one of my 205's for a while.

 

I think I've found a wiring diagram (I'll attach it later) that references the later three plug MM1AP ecu like I have fitted to mine and the wiring looks simple enough to sort into my car.

 

I still need to find the same wires as with any other conversion for the ignition switched feeds, rev counter, K light, battery positive and fuel pump feed to connect into the 205 loom.

 

Does anyone know if the method to keep the ecu in an unlocked state is the same as with the earlier single plug ecu's of disconnecting the battery asap (within 10 seconds) after switching the ignition off.

 

g

[Thijs_Rallye 87 4 Cars]

If you can post a picture of the sticker on the ecu I can google around a bit. I suspect these need a re-write and/or emulator to immo off.

[pug_ham 244 3 Cars]

21 hours ago, Thijs_Rallye said:

If you can post a picture of the sticker on the ecu I can google around a bit. I suspect these need a re-write and/or emulator to immo off.

OK, I'll get a picture of the ecu in the next few days but I was hoping it would just be the same as the earlier models with the single plug and if the battery was disconnected quickly enough the BSI didn't have chance to write a new lock code.

 

I don't think many people have tried to use the parts from the later Xsara for this conversion but I thought seeing as I have the whole car to work from, I might as well give it a try.

 

g

 

 

[pug_ham 244 3 Cars]

On 11/26/2022 at 8:26 PM, Thijs_Rallye said:

If you can post a picture of the sticker on the ecu I can google around a bit. I suspect these need a re-write and/or emulator to immo off.

 

 

I've also attached the wiring diagram I think supports the later three plug ecu and I've added the wires I need to find for the connections to get it up and running in a 205.

 

 

g

 

 

[Thijs_Rallye 87 4 Cars]

Information is all over the place on teh internets. Some say start the engine and cute wire 3 and 4 from the middle connector and it should be good to go. That might be easy enough to test on the donor. Others talk about installing an immo emulator in the ECU (which involves reading the flash of which I don't know if it can be done with the memory on the circuit board. Personally I'd give the first option a go but I think it is more involved that only cutting the CAN wires off on a running engine.

 

My search query:

https://www.google.com/search?client=firefox-b-d&q=IAW+48P2.60+immo+off 

 

https://carlabimmo.com/manuals/immobilizers/peugeot/manual.pdf

https://www.youtube.com/watch?v=IYBIWRNxPOU

https://carlabimmo.com/manuals/immobilizers/citroen/citroen-peugeot1.pdf

[pug_ham 244 3 Cars]

Thanks Thijs, that's given me a few things to look into before I get to far into the stripping of the car.

 

I'll have to remove the steering column cowl because I suspect I can test any method out by unplugging the ignition barrel chip reader thing that fits around it. (can't remember the proper term for it).

 

g

[Thijs_Rallye 87 4 Cars]

If I am not mistaken you have one of the first cars with a BSI, afaik the immo antenna runs to BSI which unlocks the ECU. Maybe @SRDT knows more about these platforms.

 

If you find info on mhh auto which you can't download shoot me a PM or post it here since I have an account there. I found an immo calulator yesterday evening but I hadn't had the time yet to revive my XP laptop since it wouldn't run on my win10 machine. But it is likely I'll need a flash dump for that and the only methods I've seen need unsoldering the flash memory (which is beyond my skillset :P).

[pug_ham 244 3 Cars]

OK, thanks for the offer on the mhh auto downloads, I'll see how I get on with the other methods first  before I look at a reflash to remove the immo.

 

I've stripped a couple of 2000/2001 306 hdi's that had a basic bsi which had the anttenna for the immo, as I believe did the 306 GTI-6 through it's later life post keypad security.

 

I think the Xsara started to get the BSI from around 2001, mines a 2003 model so towards the end of the VTS coupe's life.

 

It's a shame there isn't an option to disable the immo through Lexia, I've got an xp laptop with it running that I could do it with.

 

g

[SRDT 175]

If I remember correctly on the older ECU you change the software for one that can clear the internal memory (that I think is inside the CPU), once it's done you simply put back the original soft. This way the ECU is unlocked like a brand new one and will start any car once then be paired to it. The last trick is to cut the corresponding wire or the trace inside the ECU so that it won't get paired ever again.

 

It seems that on your ECU some people just change values inside the flash memory chip after desoldering it and it's done. On the other hand they are others that can't make it work so either they are doing it wrong or the internal security was improved at some point.

The Julie Emulator should work just fine either way, at least according to it's manufacturer.

Edited November 29, 2022 by SRDT

[Thijs_Rallye 87 4 Cars]

On 11/29/2022 at 10:57 AM, pug_ham said:

It's a shame there isn't an option to disable the immo through Lexia

That would kind of beat the purpose of an immobilizer. The diesel engines use Bosch ECU's, those are easy to de-immobilize.

 

I wouldn't be surprised if there are companies who can switch them off without opening the ECU, I just don't know any since I never had this issue myself. 

 

@SRDT The Julie emulator will work fine but it will still need unsoldering the flash memory and reading it with a reader which will need special skills and tools to do so. Unsoldering is also not without risk if one is inexperienced.

[pug_ham 244 3 Cars]

3 hours ago, Thijs_Rallye said:

That would kind of beat the purpose of an immobilizer. The diesel engines use Bosch ECU's, those are easy to de-immobilize.

 

I wouldn't be surprised if there are companies who can switch them off without opening the ECU, I just don't know any since I never had this issue myself. 

 

@SRDT The Julie emulator will work fine but it will still need unsoldering the flash memory and reading it with a reader which will need special skills and tools to do so. Unsoldering is also not without risk if one is inexperienced.

Haha, true but it'd still be handy, it's not like anyone would really know other than you.

 

There are companies who can professionally unlock the ecu, just I wondered if there was any simple way around it like with the earlier single plug ecu cars.

 

I have a single plug loom and ecu which I'm still considering using as the later ecu has both pre & post cat lambda sensors and the down pipe I have only has a single boss atm.

 

I'm not handy enough with a soldering iron to even consider desoldering anything from the ecu board.

 

g

[pug_ham 244 3 Cars]

On 11/28/2022 at 6:04 PM, Thijs_Rallye said:

Some say start the engine and cute wire 3 and 4 from the middle connector and it should be good to go. That might be easy enough to test on the donor.

 

Looking at the info you linked to from carlabimmo, I should be able to just cut the wires into the middle plug as in the picture below with the engine running and that will remove the immobilizer from the ecu.

 

 

Does that sound right?

 

g

[Thijs_Rallye 87 4 Cars]

On 11/30/2022 at 4:16 PM, pug_ham said:

Haha, true but it'd still be handy, it's not like anyone would really know other than you.

I agree but afaik no OEM tool allows you to disable the immo permanently.

 

For some reason my reply got lost. What I read in the manual is that you will need to extract the rolling code from the flash memory first, program that into the emulator, install the emulator and then snip the CAN lines.
 

But since you have the complete running donor now to play with I would give the running engine CAN snip a go. If that works it will cost you nothing :).

Edited December 1, 2022 by Thijs_Rallye

[pug_ham 244 3 Cars]

On 12/1/2022 at 4:17 PM, Thijs_Rallye said:

I agree but afaik no OEM tool allows you to disable the immo permanently.

 

I'd only need to disable it temporarily, then once it's unplugged from the car, surely there's no way for it to lock itself again?

 

Anyway, I've not had time to continue with stripping the car recently to try anything but I just thought earlier today, if the old method of battery disconnected within 10 seconds of switching it off leaves the ecu unlocked, which I did when I last had it all running, would trying to start it with the chip removed from the key be a method to test if it is unlocked?

 

g

[Thijs_Rallye 87 4 Cars]

I think you will also need to disconnect the communication from the ECU to the antenna and (if present) the immobox.

 

The chips often break when you try to extract them from the key, safer would be to relocate the antenna around the ignition switch for that test.

[pug_ham 244 3 Cars]

10 hours ago, Thijs_Rallye said:

I think you will also need to disconnect the communication from the ECU to the antenna and (if present) the immobox.

 

The chips often break when you try to extract them from the key, safer would be to relocate the antenna around the ignition switch for that test.

Ok, that should be easy enough, I'll strip the steering column shroud off next time I go up and see but I've got the spare key so if the chip breaks and it won't start I can still try another method and cut the wires on the ecu plug with it running.

 

g

[pug_ham 244 3 Cars]

Forgot to add these a couple of days ago but the diagram I first posted is likely not the one I need for my car as it only has the single lambda but thankfully I got access to autodata and got the right diagrams. (now 

attached).

 

 

 

g

XU10J4RS_MM1AP.pdf

[Gaz D 6]

[welshpug 1,657]

Its a 48p2.60   as Graham posted above, 3 plug twin lambda.

 

1ap10 is the single plug single lambda ecu which was also used by the 16v tu in wasted spark.

[pug_ham 244 3 Cars]

Well, I got an our on the car this morning and so far the ecu is still locked.

 

I tried it initially with the transponder ring removed from the ignition barrel but the immo key symbol remained on the dash & obviously the car wouldn't start so I had a few tries while it was powered up.

 

Where is the bsi / immo box live on the Xsara?  I think i unplugged the airbag / pretensioner ecu that sits under the centre console, which obviously made no difference to things.

 

 

Which of the wires do we think I need to find & cut?   

 

CAN-H B/H3

CAN-L B/H4

 

Or all;

 

K-line B/H2

L-line B/B3

CAN-H B/H3

CAN-L B/H4

 

Just for safety?

 

g.

[pug_ham 244 3 Cars]

@Thijs_Rallye  @SRDT

 

I've had a better look at the middle plug on the ecu and to say it'll be fun trying to get to the wire with the engine running is something of an understatement so I'm thinking of getting the wire where it plugs into the bsi instead.

 

So then I was wondering which box I need to get to so I can cut the wire.

 

After a bit of looking through autodata I figure its the interior box I need to unearth.

 

 

I need to find plug A on it and cut the wires into pins 2 and 14 from the wiring diagram I posted above which relate to the ecu plug B pins H3 & H4.

 

The K-line wires go the the DLC connector which I'm tempted to try & wire in also.

 

g

 

[pug_ham 244 3 Cars]

I've had a few visits to the car recently & stripped the whole dash out so i have easy access to the bsi unit & various plugs on it.

 

 

With a bit further studying of the diagrams I've got, the bsi to ecu wires run to the yellow plug A on the bsi from the middle plug on the ecu.

 

 

With the ecu & bsi plugs removed I tested the wires to make sure I cut the right ones & put it all back together to start the car.

 

 

The wires that run between the ecu & bsi are the twisted pair green & brown wires.

 

With the car running, I cut these wires in the loom running across the engine bay so I could rejoin them if everything failed along the way.

 

Cutting them with the engine running was fine, the car restarted a few times ok, but then it wouldn't start again. I joined the wires back together & it all worked again.

 

Splitting them one at a time with it running, immo light comes on dash but otherwise all good.  turned it off / on again and rev counter no longer works but started ok with immo light on dash again.

 

There must be something more cutting power to the ecu within the bsi, if I disconnected the transponder barrel with it running, wires split it would restart ok but if left a few minutes, no joy again.

 

Looking further into the diagrams, I wonder if the OBD port had any influence on things as this is one of the few other wires that run between the ECU & bsi.

 

Following @Thijs_Rallye link for his search results posted previously, I looked at one result on the MHH Auto forums that mentioned cutting the wire to F3 on the ecu plug too but this mentions use of a rar file too.

 

Looking at the diagrams, this also runs between the bsi & ecu so is another possibility to try.

 

Next time I get up there I'll find the few other wires which run between the two & start cutting a few more until things either stop working or I can start the engine with everything else cut more than a couple of times.

 

g

[pug_ham 244 3 Cars]

I've been having a bit more of a dig into this and I think I've found my problem.

 

I've found a Citroen training document for the multiplexed Xsara & Xsara Picasso that has given me a bit more info to look at. (attached)

 

Looking at the XU10J4RS_MM1AP.pdf there is a wire from bsi 1 that that runs to the engine bay fusebox / mfc cutting power to the ignition, injection lambda's as part of the immobilisation.

 

BF5 plug g via engine bay fusebox mega fuses 50a to a relay controlled by the engine bay mfc which in turn cuts power to fuse 2(fuel pump) & 15(lambda 1 & 2, evap cannister & tb heater).

 

I'm going to try to get up there again tomorrow and find this wire, cut it with the previously cut wires temporarily connected and the engine running to see if it stops it, then put a 12v feed to it & see if it runs again.

 

If it does then I need to dig further into the wiring at the engine bay fusebox end of things to find out what exactly it runs through to see if I can remove it from the system and get it working with just the immo wire to the ecu cut.

 

I did consider removing the whole BSI, transponder / immobilzer etc system & fitting it into a 205 but I reconsidered that idea when I saw it goes via the engine bay fuse box / MFC too, although it I can find the required wires I can possibly remove that from the equation & just join the wires outside of that but keep the rest functioning.

 

g.

xsara__technical_training.pdf

[pug_ham 244 3 Cars]

Well, I'm sorry to say but I'm giving up on trying to use this loom and ecu as a donor.

 

Although cutting the wire H3 between the bsi & ecu might work with the reflash on the car, I don't believe it would work to make the loom & ecu usable in another car.

 

As I discovered previously in my attempts to keep the engine starting with various wires cut, the secondary bsi in the engine bay fusebox (pictured below) was cutting the power to the coil packs, lambda etc but when trying to get voltage readings on the plugs out of this bsi to the lambda etc, they  were all low voltage so using a seperate 12v feed wouldn't work.

 

 

The socket next to the bsi you can see, all the wires from this plug run into the engine / ecu loom and the plug you can see contains the wires to the coils, lambda's etc where I was taking the voltage readings from during testing.

 

At least I have plenty of wire to use to get my single plug GTI-6 ecu and loom into the car I'm planning to fit it all into.

 

g.