Hello everyone,

I am a researched and enthusiast, and I just bought a JAGUAR F TYPE CONVERTIBLE 3.0 TELEMATICS CONTROL MODULE. I am pretty sure it's not so new, it's probably from a 2015 vehicle, but I would still like to dig deeper into the mechanisms used in this ECU. While I managed to get some usefull info from this forum (and thank you all for that), I would like to ask some questions and see if there is someone that can help me a bit with the issues I am facing:

1. From the attached picture, you can see that my ECU comes with a 32pin connector, the connector came stripped and with no information, so I started reverse engineering it. My findings so far are:
   • VCC, 12V power on pin 11
   • GND in several spots, PINs 3, 8, 16, 24, 30
   • CAN High on pins 27 and 29
   • CAN Low on pins 28 and 30
2. The ECU draws 0.03 A of power, which is signifficantly low and probably means that the ECU is either not booting, or is at a sleep state and waits for an ignition signal.
   • Is there an ignition Pin? is it any of the 32pins on the connector?
3. CAN does not seem to supply anything useful, and is not answering to any application layer protol (e.g. UDS, XCP, etc.)
   • Is there a known wake-up sequence used by Jaguar / Land Rover for those ECUs?
   • Are there application layer protocols implemented?
   • Should a 120Ohm resistor used in between me and the ECU, to properly communicate over CAN?
4. I discovered another "pair" of cables from the connector, which leads to two different MOSFETS, should I evaluate these pins further?

This is the state I am in right now, and I would appreciate any help/information that you can supply regarding my efforts. Are there any wiring diagrams online that I can find for cheap? Are there any public information regarding this connector, the CAN implementation of Jaguar, UDS implementation, hardware specifications?

Thank you all in advance.

Best,
Thomas

 

WOw! Way over this old man's head. But I applaud you for the knowledge you have learned!!

 

Thanks for the response. Let's hope that someone will be able to help make even more progress.

 

Well...
Here's a very useful network diagram for the car's various networks. Unfortunately, I don't see what might be considered the telematics module listed, and I don't really see another name for it.
https://www.dropbox.com/s/e6fp29b26h...works.pdf?dl=0

While I've worked with a number of single-ended and differential data buses, CAN isn't one of them. Generally, you need termination (120 ohm for CAN) at the physical ends of the data bus for signal integrity, but for a short connection, you probably don't. (These are shown on the network diagram.) However, without the pair of 120 ohm terminators, the DC levels of the bus are likely off, though probably not an issue.

Here is the telematics wiring info - notice that it's on both the HS (high-speed) and MS (medium-speed) CAN buses.
https://www.dropbox.com/scl/fi/moawo...zr2ccpxs0&dl=0

I extracted that from this 270MB PDF document, which another member shared...
https://www.dropbox.com/scl/fi/o6d1x...k7yc02pyx&dl=0

Lastly, here's the definition of the wiring diagrams, explaining how to interpret them. Unfortunately, it also explains extra features which would be available through the Topix website but not in the PDF...
https://www.dropbox.com/s/x26e91fmqu...ns%20.pdf?dl=0

Also, you refer to this a few times as 'ECU', which would be the Engine Control Unit, which this is not. And for the F-type at least, 'TCU' is the Transmission Control Unit.

And lastly, I would supply it with 13.8V, not 12.0V. The electronic modules in these cars can be quite sensitive to operating voltage, and 12.0V isn't really a valid voltage from the battery.

 

Just as a note:
ECU - Electroinc Control Unit
ECM - Engne Control Module
PCM - Powertrain Control Module
ECM, PCM, TCM, TCU, AHU - these are all ECU's

Back to the TCU:
CAN bus should be terminated (60 or 120 ohms, depending of a bench configuration), 11bit ID's, UDS for generic comms, CCP present (however you'll need to find correct ID's).
To access a memory you'll need a SBL to be loaded.
To power up a module BCM should broadcast wake-up signal, ignition on signal and broadcast a CCF data. There's a workaround - you are pretty much able to enter a programming session within a small time-frame after powering a module, when a PBL is active and communicating.

 

Hello,

Thank you both for the input, it's actually really helpful, and it will help me evaluate further. I will update you as soon as I have some info, as I need to find a clever way to enumerate the ID's, in a short timespawn after boot.

On the remark of ECU naming, I actually work in the automotive industry for more than 5 years (both traditional and start-up clients) and the ECU abreviation always refers to Electronic Control Unit as MoscowLeaper mentiones. In the past, several manufacturers might be referuing to the Engine Control Unit, but now that even then simples of vehicles has at least one ECU, all of them have a different name and all are characterized as ECUs which is nothing else other than an embedded system, running in different architectures depending on the implementation. Also, regarding the TCU abreviation, it really depends on the manufacturer and the target vehicle.

 

Even in a PathFinder the modules are referred as ECU's
Have a look - exact module is PSCM (Power Steering Control Module), but replace and update option refers to it as an ECU. Same for all the others actually.

For a 2014-2017 TCU:
Local config file 00020000-0002FFFF
Application 00030000-007FFFFF
CAN signal configuration data base 00040000-0004FFFF
Secondary bootloader 1C021000

I'd leave other info in secret

 

Success gents <3

I got UDS on the device over one of the interfaces.

I will keep you updated. Thank you all for the support.