★ Hall of the great Volvo tinkerers

Legends

Almost nothing here was figured out in isolation. This is the roll call — the people and archives who did the deep work on these cars and shared it, so the rest of us could learn.

Featured maker

Johnny Persson — P3Tool & P3KeyCleaner

Built P3Tool to edit P3 CarConfig without paying per change, then P3KeyCleaner to re-use old Volvo keys. Both are archived here and on his site.

01 The P3 retrofit masters — the shout-outs

02 P3 configuration tooling

03 P3 OEM-retrofit build threads

04 Russian P3 knowledge

05 P3 CAN & cluster hacking (code)

06 240 / RWD brick community

07 Parts & upgrades

Outbound links point to independent sites we don’t control and aren’t responsible for. Listing something here isn’t an endorsement of everything on it — and if you own one of these and would rather not be linked, say the word and it comes down.

◆ A second shelf, indexed differently

The Bench.

The shelf above is filed by who. This one is filed by which part of the job — understanding the lock, getting data off the board, writing a twin, repairing instead of replacing, and running a module on the desk. Each entry lists what it actually hands you, extracted and written out here, so the index is worth reading on its own.

01

Understand the lock

Why a module is married to a car at all. Two separate PIN layers, which modules carry one, and what a used unit is actually refusing to do.

map

Volvo PIN Codes Explained

d5t5.com article English free read & checked

The clearest statement anywhere of what a Volvo PIN actually is — and the key insight that there are two of them, guarding different things.

What it yields

  • Two distinct PIN layers: a programming-memory PIN (CEM software + configuration table; ECM engine maps from ~2008) and an IMMO PIN guarding the EEPROM that holds the sync codes needed to start the car
  • Modules that carry a PIN: CEM, ECM, and on newer cars IEM, VGM, the BCM brake unit, the SCL steering lock, ignition keys, remotes and the audio system
  • CEM PIN is decodable on P1 GGD 2011+, P2 GGD (XC90 3.2 / 4.4 V8 / 147 kW and 120 kW D5 MY13+), P3, and SPA 2015-2018
  • ECM PIN is not needed on P1 before ~MY2011 or on P2 — but is required for P3 Denso units and SPA 2015-2018
  • VGM PIN cannot be decoded over OBD at all on Android-based iCUP cars
  • Three acquisition routes exist: decode over OBD, bench-read after removing the unit, or intercept VIDA programming (which violates Volvo licensing)
procedure

How to Obtain the CEM / ECM PIN for Your Volvo

d5t5.com article English free read & checked

The same author's practical follow-on: every route to a PIN, per platform, with real time figures rather than vague promises.

What it yields

  • VDASH decode over OBD: up to 24 hours, usually around 8
  • VDD decode: approximately 30 minutes (P2 vehicles 2005-2014, with exceptions)
  • Bench route by platform: BDM programmer on P2, JTAG programmer on P3 — then upload the resulting BIN to d5t5.com/pin/
  • Post the physical CEM in and get the PIN back within 48 hours
  • SPA / CMA: VDASH up to 24 hours, and it cannot decode iCUP / Android cars at all
  • Interface requirements: DiCE or a generic J2534, connected by USB and not Bluetooth, with a supply rated at least 12 A

The USB-not-Bluetooth requirement matches what we found the hard way on our own DiCE.

02

Get the data off

The silicon. Which microcontroller, which EEPROM, which operations, and whether the job is done over the connector or on the board.

The open-source route is already on the shelf below — vtl/volvo-cem-cracker, the Teensy PIN brute-forcer.

spec

OBDSTAR G3 on the Delphi P3 CEM (M30882F)

blog.obdii365.com vendor blog English free not machine-readable

A tool vendor's release note, and incidentally the closest thing to a public spec sheet for the exact CEM in our own car.

What it yields

  • The P3 Delphi CEM's microcontroller is a Renesas M30882F — internal flash read and write are separate listed operations
  • The external EEPROM is a 95320 (SPI), with both raw and decrypted read/write called out separately
  • Config-zone read/write is its own operation again, distinct from flash and from EEPROM
  • All of it is bench-level work on the removed module, not an OBD procedure

The host's TLS certificate has expired, so this one could not be re-fetched to our usual bar — the operation list above came out of the search index rather than a direct read.

03

Write the twin

Making a donor believe it is your module: sync, key recovery, block cloning. This is the paid trade, and the vendors are unusually explicit about which memory variants they handle.

spec

Volvo-Fix — CEM & ECM synchronization and cloning

volvo-fix.com service English paid read & checked

A working cloning shop that publishes its own capability matrix — which is far more informative than the marketing suggests, because the matrix names the actual memory parts per platform.

What it yields

  • Sells exactly the thing this whole page is about: synchronization, key recovery and CEM-ECM block cloning, at $80 per unique VIN
  • P2 sync names the real memory variants it handles: 93LC86 and 28F400 CEM models
  • P3 covers CEM/ECM sync across EDC17, MED17 and Denso configurations
  • SPA has its own config editor for CEM units SPC5646 and SPC5748, plus CEM+ECM Denso sync (spc5646, R5F72546R), an SCL steering-lock disable, and a VCM key & PIN calculator
  • P1 spans SID807EVO, SID206, ME9.0, Visteon, Denso and EDC engine variants
  • Side capabilities that tell you what else is soft: mileage editing across several modules, IMMO3/ECM block recovery, MOST security disable
primary

Matthews Volvo Site — "Vida CEM swapping"

www.matthewsvolvosite.com forum English free not machine-readable

265 pages of people doing this to their own cars, over years. The single best primary-source record of what actually fails and which swaps take.

What it yields

  • A running, unedited log of CEM swaps attempted with VIDA — including the ones that didn't work, which the vendor pages never publish
  • The practical failure modes in owners' own words, rather than the tidy version

The forum returns 403 to automated fetches; open it in a browser.

04

Fix instead of replace

Most CEMs that get replaced didn't need to be. Cracked joints, dead relays, one missing supply rail — all board-level, all reversible, none of it touching the immobilizer data.

service

XeMODeX — P2 CEM repair service

xemodex.com service English paid read & checked

Worth reading not to buy it but because the scope is stated so narrowly — it is a precise description of one specific board fault and nothing else.

What it yields

  • The whole service is restoring the fuse #15 wake-up supply, which fixes loss of CAN communication with the brake module (BCM)
  • Covers S60 2005-09, S80 2005-06, V70 2005-07, XC70 2005-07, XC90 2005-14
  • $399, down from a $995 MSRP, same-day turnaround
  • Explicitly plug and play: software and settings are not modified, so nothing needs reloading or calibrating afterwards
  • Any other CEM fault is pushed to their separate CEM Program Transfer service — which is the cloning path under a politer name
procedure

Volvo Owners' Club — replacing a headlamp relay inside the CEM

www.volvoforums.org.uk forum English free read & checked

The best physical-work reference on this list. A complete board-level repair with the relay sourced by part number — proof that the common CEM death is a $2 component.

What it yields

  • The relay is a 15 A 12 VDC SPDT, five pins — Mouser 769-JSM1-12V-5, about $2 (UK: CPC order code SW03934)
  • Five solder points on the underside of the board per relay
  • There are two headlamp relays on the board; the middle one is the right-hand side
  • Removal: negative terminal off, felt trim above the pedals, four Phillips for the trim below the wheel, four connectors off the CEM, two screws, then pull it out sideways
  • There is a hidden screw behind the product label — the housing will not separate before it comes out, and prying first is how people break them
  • Budget around 25 minutes of gradual desoldering, heating each pin a little at a time
  • Tools: soldering gun, solder, a solder-removal tool, 10 mm socket, Phillips and small flathead
  • Read the radio code off before disconnecting the battery
procedure

FCP Euro — how to repair a relay

www.fcpeuro.com article English free read & checked

The technique rather than the specification — opening a relay and reflowing its cracked joints instead of buying a new one.

What it yields

  • Five steps: check the casing, open it with two flat-head screwdrivers, find the cracked joints by eye, reflow or add solder, snap it back together
  • Tools: soldering iron, two flat-heads, braided copper wick, solder compatible with the existing joints
  • Only works on plastic-cased relays — metal cases are the problem case
  • Carries no Volvo part numbers and no board specifics; it is demonstrated on an overdrive solenoid relay and generalised to all mechanical relays
procedure

SwedeSpeed — CEM part transplant (repairing pin damage)

www.swedespeed.com forum English free not machine-readable

Someone moving parts between two CEM boards to save a working one with a damaged connector — the honest difficulty calibration for this kind of rework, with photos.

What it yields

  • Board-level component and connector transplant between two CEM units, photographed through the job
  • The realistic answer to "could I do this myself" — a working module saved by donor parts rather than by data

SwedeSpeed now routes automated fetches through a paid gateway (402 Payment Required); open it in a browser.

05

Run it on the desk

Powering a module outside the car and talking to it over simulated CAN — the difference between owning a junkyard CEM and being able to learn from one.

Pairs with andrewgabler/VolvoDIM on the shelf below, which drives a P3 cluster standalone.

map

Volvo TechNest — bench tool for Volvo electronics (MHH Auto)

mhhauto.com forum English forum acct not machine-readable

The most interesting thing on this list and the hardest to get at — a tool for exercising Volvo modules on a bench with a simulated car around them.

What it yields

  • Bench testing of DIM and ICM modules with CAN bus simulation — the module runs believing it is installed
  • P3 CEM coding: read, write and modify
  • Distributed through a trade forum with per-module licensing and no public pricing, which is why it barely surfaces in ordinary searches

MHH Auto returns 403 to automated fetches and needs a forum account. Highest ratio of capability to accessibility on the page.

◆ Our own contribution

P3Config work.

The configuration work on our own S60 lives on the workshop laptop next to VIDA. It’s the same idea the retrofit community is built on: a P3 car holds far more capability in its module configuration than any single trim was allowed to use, so a good deal of “adding a feature” is really telling the car what it already is.

P3 platform → Projects →