2004 Renault Trafic 2

Alberto said:

Hello everyone,

I have a problem with my 2004 Renault Trafic 2 after an...

Click to expand...

Hello,

Let's take it step by step because there are several things mixed together here:

1. The instrument cluster problem

After an immo deactivation in the ECU, it is very common for the cluster and the UCH to lose synchronization with the ECU. Stuck needles and warning lights normally indicate that CAN communication between the ECU and UCH is no longer consistent, not necessarily a fault with the UCH itself.

Before touching the UCH, confirm:

• Which ECU is fitted exactly? (Bosch, Delphi, Siemens — HW/SW if you can read it)
• How was the immo deactivation performed in the ECU? (IMMO OFF via software/virginization/emulator)
• Did the cluster work correctly before the deactivation?

2. Error 7F 3B 22 in the UCH

The UDS code 7F 3B 22 means:

• 7F = Negative response
• 3B = WriteDataByIdentifier service (writing)
• 22 = conditionsNotCorrect

This means that the UCH rejects the write because you have not previously opened a valid security session (Security Access, service 27). It is not directly a problem with an incorrect PIN, but rather that RenOLink is not completing the service 27 challenge-response before attempting to write.

3. About the ISK and PIN

For the Sagem type 9366 UCH in the Trafic 2 (2004):

• The ISK (Identification Secret Key) you read (00 0E 23 D7 0E C4) is the 6-byte cryptographic key used by the UCH for aftermarket login.
• The ISK is NOT directly a 4-digit PIN. They are different things.
• What the extractor gave you (ZC 77 0A 3F CE FC) appears to be another 6-byte value, not a 4-digit PIN either.

In Sagem UCHs of this generation, the correct procedure is:

1. Open an extended session (service 10 03)
2. Request seed (service 27 01) — the UCH returns a challenge
3. Calculate the key from the seed + ISK using the specific Sagem algorithm
4. Send the key (service 27 02)
5. Only then can you write (service 3B / 2E)

4. What you actually need

RenOLink should perform this calculation automatically if you enter the ISK correctly. If it does not accept it, check:

• Which version of RenOLink are you using? Older versions do not properly support the Sagem 9366 UCH.
• Are you entering the ISK in the correct field? Some tools ask for the ISK in decimal format, not hexadecimal.
• Your ISK 00 0E 23 D7 0E C4 in decimal would be: 0 14 35 215 14 196

5. Recommendation

Before continuing to struggle with the UCH, I need you to confirm:

• Exact ECU model and method of IMMO OFF used
• RenOLink version
• Whether you have the possibility of using CLIP (Renault CAN Clip) — with CLIP and the correct access code, the procedure is much more reliable for these UCHs
• Do you have the vehicle's original tarjeta/llave?

The underlying problem is probably that the ECU is no longer sending the IMMO validation frame over CAN, and because the UCH does not receive confirmation, it blocks cluster functions. The solution may involve reconfiguring the UCH so that it accepts the ECU's new status, or correcting the immo deactivation so that it maintains proper CAN communication.

Send over those details and we'll see how to proceed.

ECU Details:

• Model: EDC15C13
• Manufacturer: BOSCH
• Part Number: 0281011529
• Hardware Reference: HOM8200051608

Tools Available:

• RenOLink: Version 2.10
• Renault CAN Clip: Currently no access, but could potentially source one.
• Key: Original key is available.

Background:The vehicle was purchased as a non-runner with a suspected faulty Engine Control Unit (ECU). After troubleshooting, I discovered a broken CAN bus wire. I am looking for the correct software-based procedure to perform an IMMO OFF on this specific unit.

Diagnostic Data:I have attached a screenshot of the current fault codes and readings below for your analysis.

---

Technical Notes for the Forum​#

• IMMO OFF: Anulamiento del inmovilizador.
• Non-runner / Faulty: Averiado.
• Broken wire: Cable partido.
• Sourced / Access to: Conseguir acceso a.
  

Alberto said:

ECU Details:


Model: EDC15C13
Manufacturer: BOSCH
Part Number: 0281011529
Hardware Reference: HOM82...

Click to expand...

Perfect, the picture is now much clearer. Let's put everything in order:

Situation summary

What really happened is that the car would not start because of a broken CAN wire, not because of the ECU itself. This is important because it completely changes the approach.

1. About the ECU — Bosch EDC15C13 (0281011529 / HOM8200051608)

This ECU uses the Renault IMMO type 2 system (IMMO communication via the K-line between the UCH and ECU, not via CAN). The standard procedure for IMMO OFF on the EDC15C13 is:

• Read the ECU's complete dump via BDM (BDM connector on the board, processor MPC555/556)
• Modify the IMMO bytes in the dump (IMMO synchronization area)
• Rewrite via BDM

Valid tools for this:

• BDM100, Galletto, MPPS (via BDM, not via OBD in this case)
• This can also be done with KTag or Trasdata via BDM

2. BUT — before doing IMMO OFF, consider this:

If the original problem was a broken CAN wire and you have already repaired it:

• The ECU is probably fine and synchronized with the original UCH
• You have the original key
• You have the original UCH (Sagem 9366)

→ You may NOT need to perform IMMO OFF at all.

The key question is: Has anything already been done to the ECU, or is it in its original state?

3. About the Renault Pin Extractor screenshot

What I see in the image:

• Pin Code: 7C 77 0A 3F CE FC — this is the aftermarket login code calculated from the UCH dump, it is NOT a 4-digit PIN
• ISK: 00 0E 23 D7 0E C4 — this is the UCH's secret key
• VIN: VF1FLBCA64Y044377

For RenOLink, what you need to enter depends on the function you are using:

• If you use the "Learn key" function → you need the vehicle's 4-digit PIN (obtained from the key's PRECODE or from Renault, not from the ISK)
• If you use the "Configure UCH" function → Security Access must work, and this is where the ISK comes in

4. Recommended action plan

Step 1: Confirm that the CAN wire has been properly repaired (60Ω resistance between CAN-H and CAN-L at each end)

Step 2: With the original key, try to start the car without having touched the ECU. If it starts:

• The instrument cluster problem (needles, warning lights) will probably be resolved by clearing faults with RenOLink or CLIP
• You do not need IMMO OFF

Step 3: If the ECU has already been modified or virginized:

• You need to re-synchronize the ECU + UCH + key
• With RenOLink 2.10 and UCH Sagem 9366, the function is "UCH ↔ Injection Matching" or similar
• This is where you will need the ISK for Security Access

Step 4: If you decide to perform IMMO OFF on the EDC15C13:

• Read the complete dump via BDM
• Upload the dump here (or the IMMO area) and we will tell you the exact bytes to modify

What do I need you to confirm?

1. Is the ECU in its original state, or has any modification already been made to it?
2. With the CAN wire repaired and the original key, does the car start?
3. Do you have a BDM tool available to read the ECU?
4. Does the instrument cluster display the odometer, or is everything dead?

With these answers, I will give you the exact step-by-step procedure.