Can-Related Faults And Central Electronic Module (CEM), Description And Operation

The following information explains how the structure of the CAN network, its function and how the on-board diagnostic system works. It also explains the circumstances under which diagnostic trouble codes (DTCs) are stored, as well as containing a few tips on how to conduct fault-tracing on the CAN network. Faults in the CAN network are often complicated to fault-trace because it is a distributed system and because diagnostic trouble codes (DTCs) are stored under different circumstances in different control modules.

The following information should ideally be used as a basis for understanding how the CAN network works, diagnostics for the system and how to carry out fault-tracing. There is no guarantee that it will help you find a fault source for a specific problem immediately. The following information should be viewed as a supplement to the normal training information and is suitable for mechanics who have completed and understood the content of the "Volvo Automotive Networks" course.

Diagnostic functions in the central electronic module (CEM) 

The central electronic module (CEM) is the only control module that monitors the voltage levels in the control area network (CAN). Only this control module can store diagnostic trouble codes (DTCs) for short-circuits between the CAN cables and ground or supply voltage (e. g. DTC CEM-DF14). However, other control modules can store diagnostic trouble codes (DTCs) for causes based on a short-circuit (e. g. DIM-E003). This is a small, but very important difference.

The central electronic module (CEM) also has functions for determining whether other control modules have failed. All control modules on the CAN network must transmit and receive information. More specifically, all other control modules in the controller area network (CAN) must receive information from the central electronic module (CEM), and the central electronic module (CEM) must receive information from all other control modules in the controller area network (CAN). If a control module does not receive information from the central electronic module (CEM) it will store diagnostic trouble code (DTC) XXX-E003. If the central electronic module (CEM) cannot receive information from a control module it will store diagnostic trouble code (DTC) CEM-1A51 to CEM- 1A66 depending on which control module the central electronic module (CEM) is not receiving information from. For example, the climate control module (CCM) will store diagnostic trouble code (DTC) CCM-E003 if it does not receive information from the central electronic module (CEM), and the central electronic module (CEM) will store diagnostic trouble code (DTC) CEM-1A55 if it does not receive any information from the climate control module (CCM).

If there is an open-circuit in the CAN network, diagnostic trouble codes (DTCs) will be stored in pairs, one in the central electronic module (CEM) and one in the relevant control module. Note that this may result in the central electronic module (CEM) storing so many diagnostic trouble codes (DTCs) that it reaches its maximum (10).

These diagnostic trouble codes (DTCs) are explained in detail under Diagnostic trouble codes (DTCs) CEM-1A51 to CEM-1A66.

Diagnostic trouble codes (DTCs) for faults in the CAN network 

Diagnostic trouble codes (DTCs) CEM-DF03 to CEM-DF16 

The central electronic module (CEM) is the only control module that can detect a short-circuit to ground or to voltage. This is done by measuring the voltage level on the CAN cables via an internal voltmeter in the central electronic module (CEM) and as a result the diagnostic trouble codes (DTCs) CEM-DF03 to CEM-DF16 can be stored.

There is no defined function for detecting an open-circuit in the CAN cables, but a number of diagnostic trouble codes (DTCs) will be stored as a result of an open-circuit. Diagnostic trouble codes (DTCs) CEM-DF03 to CEM-DF16 are the strongest indication of a fault in the CAN network, although the diagnostic trouble codes (DTCs) cannot localize the fault. Due to the criteria that cause these codes to be stored, diagnostic trouble codes (DTCs) can also be stored if the car is driven in areas with strong magnetic fields.

The CAN cables are monitored continuously for faults of this type. It can take up to ten seconds from the time the fault occurs until the diagnostic trouble code (DTC) is stored. Diagnostic trouble codes (DTCs) CEM-DF03 to CEM-DF16 are stored when the voltage on one of the CAN cables is higher than 4.5 V or lower than 0.5 V. A typical scenario when these codes are stored is when one of the CAN cables has been clamped together with a ground lead or a power supply cable.

Diagnostic trouble codes (DTCs) CEM-1A51 to CEM-1A66 

The central electronic module (CEM) expects to receive a signal from each control module on the network. The control module stores a diagnostic trouble code (DTC) for faults in the communication with a control module, or "node not alive", if there is no communication for more than ten seconds.

The diagnostic trouble codes (DTCs) are normally stored in the event of an open-circuit in the CAN cables, a short-circuit to voltage or ground, when the control module has no supply voltage or if other circumstances cause the control module to stop communicating with the central electronic module (CEM). Combinations of diagnostic trouble codes (DTCs) CEM-1A51 to CEM-1A66 are very useful for localizing a fault in the network. See "Multiple diagnostic trouble codes (DTCs) and extended diagnostics  " below.

If the status of diagnostic trouble codes (DTCs) CEM-1A51 to CEM-1A66 is intermittent, always check that communication is possible between all control modules when carrying out repairs. Then check the power supply and ground for the affected control modules. The control module will not store a diagnostic trouble code (DTC) if it was without power when the fault occurred. The central electronic module (CEM) on the other hand will store diagnostic trouble code (DTC) CEM-1A5X or CEM-1A6X even if the control module has no power supply or is experiencing other CAN communication problems.

Diagnostic trouble code (DTC) XXX-E003 stored in control modules other than the central electronic module (CEM) 

Diagnostic trouble code (DTC) XXX-E003 is stored when an incorrect CAN configuration ID is received from a control module within 5 seconds of start up. This means that the control module cannot receive the data message with the correct Master Configuration ID that the central electronic module (CEM) transmits. This is normally due to an open-circuit on the CAN cables or some other interference in communication.

The diagnostic trouble code (DTC) is intended to detect whether the central electronic module (CEM) has defective software, but is more common when there are faults in the CAN network or faults in the power supply to the control modules. A combination of E003- codes makes it easier to localize the fault, see "Multiple diagnostic trouble codes (DTCs) and extended diagnostics  " below. On the other hand, the diagnostic trouble code (DTC) is not stored at the same time in all control modules. This depends on the power supply to the control modules (e. g. X / 15 / 15I / 30).

The diagnostic trouble code (DTC) can be stored if incorrect software is downloaded into a control module or if a control module is moved from one car to another. This is why moving control modules between cars is not permitted. If several or all control modules have stored diagnostic trouble code (DTC) E003, this may be due to an incorrect signal configuration having been downloaded into the central electronic module (CEM). This is not particularly likely in practice, however, but is more often due to a physical fault in the CAN network.

X/ 15I / 15 supplied control modules can detect the fault five seconds after the control module has been powered up (ignition on). The control module compares its own CAN configuration ID (SW version) with the CAN configuration ID that is continuously transmitted by the central electronic module (CEM). Diagnostic trouble code (DTC) E003 is stored by the control module if the central electronic module (CEM) ID is absent or is different from the anticipated value five seconds after the control module has been powered up. An incorrect CAN configuration ID may be the result of a control module having been taken from one car and installed in another, although the diagnostic trouble code (DTC) is usually stored due to the signal being completely absent. A control module that is supplied directly from the battery (30) does not follow the same start up procedure as other control modules, but receives information about the position of the ignition key via the CAN network. This means that a 30-supplied control module will not store diagnostic trouble code (DTC) E003 5 seconds after the ignition is switched on if there is a permanent fault. The control modules will store the diagnostic trouble code (DTC) after a time-out lasting approximately ten minutes instead.

A typical reason for E003 being stored is an open-circuit in the CAN cables. In this case, the diagnostic trouble code (DTC) is often stored together the codes CEM-1A51 to CEM-1A66.

Diagnostic trouble codes (DTCs) E000 and E001 in a control module (E000=HS-CAN, E001=LS-CAN) 

Diagnostic trouble code (DTC) E001 indicates a fault in the data communication on the CAN network. This can be due to interference of various types or if a control module is sending incorrect messages. Monitoring for this type of fault takes place continuously. The diagnostic trouble codes (DTCs) are originally intended to indicate contact bounces of if incorrect messages are sent over the network, but can also be stored in the event of a short-circuit between the two CAN cables or if communication only functions on one of the two cables. It takes a couple of seconds from the fault occurring to its detection.

Another important cause of these codes is if a control module has been disconnected from the network without the battery cable having been disconnected from the negative terminal (in such cases removing the ignition key does not help) or if the signal on the CAN cables is "weak" or disrupted. This can occur if communication is only working on one of the CAN cables or if one of the network resistors in the network is not working. The network resistors on the low speed network are located in the upper electronic module (UEM) and the rear electronic module (REM). On the high speed network, the resistors are located in the anti-lock brake system module (ABS)/brake control module (BCM) and in the electronic throttle module (ETM), except for Bosch EMS MY02 and later where the resistors are located in the brake control module (BCM) and the engine control module (ECM).

In certain cases, the diagnostic trouble code (DTC) may be stored if a control module sends data at the wrong transfer speed or if the crystal in a control module is defective.

Diagnostic trouble codes (DTCs) in the event of lost signal, rapid indication of faults on the CAN network 

Some control modules, such as the engine control module (ECM), the electronic throttle module (ETM), the anti-lock brake system module (ABS) and the transmission control module (TCM) continually check the existence of each other and store diagnostic trouble codes (DTCs) in the event of missing signals. These diagnostic trouble codes (DTCs) are often due to different driving conditions and combinations of diagnostic trouble codes (DTCs) are often stored which can make fault-tracing more difficult. When attempting to recreate the fault, there is no guarantee that the same combination of diagnostic trouble codes (DTCs) will be stored. The detection of these diagnostic trouble codes (DTCs) is often more sensitive and they are usually stored more easily than CEM-1A51 to CEM-1A66 or CEM-DF03 to CEM-DF16. This can therefore be an indication of a short-term intermittent fault having occurred on the CAN network.

Below is a selection of diagnostic trouble codes (DTCs) that may or may not be stored in the event of an intermittent fault on the CAN network:

• ECM-928C (Bosch), ECM-922A (Denso), only when the engine is running. These diagnostic trouble codes (DTCs) indicate that the control signal for the cruise control is missing or could not be received by the engine control module (ECM)
• ECM-901A, ECM-901E, ECM-902A, ECM-911A, ECM-912A and ECM-913A for Bosch and ECM-901A, ECM-902A, ECM-911A, ECM-912A for Denso
• SRS-00D6, time-out for the seat belt buckle. This diagnostic trouble code (DTC) indicates that the supplemental restraints system module (SRS) has not received the status of the seat belt buckles from the central electronic module (CEM). The sensor for the seat belt buckles is directly linked to the central electronic module (CEM)
• SRS-00D5, status of the SRS indicator lamp in the driver information module (DIM)
• Discrepancies in the signal from the pedal position sensor between the directly connected signal and the signal over the CAN network. See the table below.

Engine control module (ECM) Bosch
	ECM-959F	Fault when comparing the signals AP12T APU (Analog Pedal Unit) Analog and PWM (from the electronic throttle module (ETM))
Engine control module (ECM) Denso
	ECM-9520	ETS, APM, PWM, electrical fault, signal too low
Monitoring the engine control module (ECM)
Bosch
	ECM-510F	No speed signal
Denso	ECM-510D	No speed signal
	ECM-A02B	No signal from the anti-lock brake system module (ABS)/brake control module (BCM)
	ECM-902A	Communication fault with the electronic throttle module (ETM)

Multiple diagnostic trouble codes (DTCs) and extended diagnostics (counters and freeze frames) 

The detection time for faults in the CAN network varies depending on the diagnostic trouble code (DTC). This means that for different fault occurrences, different diagnostic trouble codes (DTCs) can be stored in different control modules. Several diagnostic trouble codes (DTCs) in different control modules can be confusing and must be investigated at the start of fault-tracing to check for any link between the various codes.

It is now possible to read off extended diagnostic trouble code (DTC) information in VIDA, normally counters and frozen values. This can also help with fault-tracing on the CAN network as it can provide information about diagnostic trouble codes (DTCs) that are stored simultaneously. Remember that the function using counters can be implemented differently in different control modules, which can make it difficult to compare cycles between different control modules.

When performing fault-tracing on a car with many intermittent E003 and CEM-1A51 to CEM-1A66 diagnostic trouble codes (DTCs), this can be made easier by checking the affected control modules. Write down all diagnostic trouble codes (DTCs) and counters at the relevant control modules. Check any conclusions can be drawn from where the diagnostic trouble codes (DTCs) are stored. If the diagnostic trouble codes (DTCs) are in control modules at one end of the CAN network, this can give an indication of where the fault may be located.

Limp-home modes and characteristics of control modules in the event of faults in the CAN network 

When a control module cannot receive messages from the central electronic module (CEM) it will go into Limp-home mode. In such cases, the control module can retain part of its functionality. The remaining functionality varies in different control modules. If a fault occurs after a control module has been started up, it will normally retain the most recent values as the Limp-home values. There are exceptions, such as the fuel gauge in the driver information module (DIM).

Some clear examples for the low speed side network:

• Driver information module (DIM):

  As the driver information module (DIM) only displays signals received from the CAN network, it will soon be evident if signals are lost. The display of various signals will disappear at slightly different times due to some filtering of the signals in the driver information module (DIM). The values on the gauges are normally frozen for around ten seconds before dropping to zero and the driver information module (DIM) shuts down. If only one control module has disappeared from the network, the driver information module (DIM) can display the first indication of this. An example of this is where the rear electronic module (REM) stops communicating, which is indicated by the fuel gauge dropping to zero

• Climate control module (CCM):

  This control module must retain some of its functionality even if the CAN communication is lost. It is also a very good indication of whether the CAN communication has been lost, as the LEDs will light up exactly ten seconds after the ignition key has been turned to positions one or two. Other symptoms: if the AC compressor is not working, apart from the first second when the function is checked by the engine control module (ECM), this can indicate a fault in the climate control module (CCM)>central electronic module (CEM)>engine control module (ECM) chain. Another very obvious symptom is that the blower fan continues to operate for up to ten minutes after the key is removed from the ignition switch. This is because the climate control module (CCM) is powered via Extended-X from the central electronic module (CEM). The climate control module (CCM) normally switches off the blower fan and other functions when it does not receive a signal over the CAN network after the ignition key has been removed. If there is no CAN communication, the climate control module (CCM) will continue to operate until the central electronic module (CEM) switches off the power supply

• Driver door module (DDM)/Passenger door module (PDM):

  The module will be set to a resting mode and no functions will be performed, such as setting the mirror or operating the power windows

• Power seat module (PSM):

  The memory function in the seat will not work. Stored positions for seats and mirrors will not work when the car is unlocked with a remote control

• Upper electronic module (UEM):

  The seat belt reminder will be lit, even though the belt is secured in the seat belt buckle. It will not be possible to lock or unlock the car using the remote control

• Audio module (AUM):

  The radio retains most of its functionality. However, the buttons on the steering wheel will not work

• Rear electronic module (REM):

  The fuel gauge is not working and it will not be possible to lock/unlock the rear doors using the central locking switch. The heating loops in the rear windshield and the rear folding head restraints will not work

• Steering wheel angle sensor module (SAS):

  The anti-skid system will not work

• Steering wheel module (SWM):

  Buttons on the steering wheel and the turn signal lamp stalk will not work. However the horn will still work because it is connected directly to the central electronic module (CEM).

Some clear examples for the high speed network:

• Engines:

  Cannot be started as a result of no communication between the central electronic module (CEM) and transmission control module (TCM) + engine control module (ECM)

  • Level 1: No cruise control function
  • Level 2: Accelerator pedal "heavy". Poor response
  • Level 3: Present Limp-home mode. The engine speed (RPM) is controlled via the injectors.
• Electronic throttle module (ETM):

  The node has three Limp-home levels:

  • Level 1: No cruise control function
  • Level 2: Accelerator pedal "heavy". Poor response
  • Level 3: Present Limp-home mode. The engine speed (RPM) is controlled via the injectors.
• Transmission control module (TCM):

  It is not possible to use all the gears.

  NOTE:

  If the control module has gone into Limp-home due to an open-circuit in the CAN communication, the functionality will not return during the cycle, even in the event of the fault disappearing.

• Anti-lock brake system module(ABS)/Brake control module (BCM):

  The remaining functionality depends on what fault has occurred. In the event of a fault in the AYC sensor, the indicator lamp lights and DSTC stops working. Faults in the wheel sensors cause the indicator lamp to light and the ABS function to disappear, although there is still braking assistance. The unit can lose certain diagnostics in Limp-home mode

• Central electronic module (CEM):

  Extremely large loss of function. It is worth noting that the control module has separate circuits for the high speed and low speed networks. This means that it is possible to communicate with the control module via the high speed network even when the low speed network has a fault.

Fault-tracing tips 

If the central electronic module (CEM) has stored diagnostic trouble code (DTC) CEM-DF14 CAN low short-circuit to ground, this does not  mean that the central electronic module (CEM) is necessarily the control module which short-circuits the cable. The short-circuit may be from any part of the cable to any ground terminal or ground lead. The fault may be in a cable harness, which is the most common situation, or in a control module. Note that the diagnostic trouble code (DTC) can be stored in some control modules but not in others, and that the short-circuit in this case can be far from the control module that stores the diagnostic trouble code (DTC).

Statistically there is a high likelihood of the fault being in the cable harness (check behind the audio module (AUM), at the supplemental restraint system module (SRS), the terminals for the CAN cables in the connectors on the transmission control module (TCM) and the engine control module (ECM). Note that terminal pins (P/N 9441394) can be used to check the mating surface in the female connectors for the CAN cables. If the mating surface is defective or the terminal pins detach too easily, the female connector socket must be replaced (P/N 9442486).

If diagnostic trouble code (DTC) E001 is stored continually and the cable harness is free of faults, all control modules containing diagnostic trouble code (DTC) E001, apart from the central electronic module (CEM), must be disconnected from the CAN network. Delete the diagnostic trouble codes (DTCs) in the remaining control modules and read off diagnostic trouble codes (DTCs) again to, see if the fault disappears. Then connect the control modules again, one by one, until the diagnostic trouble code (DTC) recurs. If VIDA can communicate with the car when the ignition key is in position 0 and 1 but not in position 2, the fault is probably in a 15-supplied control module.

The above method can also be used in other scenarios. On rare occasions, control modules can begin sending irrelevant messages on the CAN network. This can prevent the correct messages from getting through. The result can be one or more E003 or CEM-1A51 to 1A66 diagnostic trouble codes (DTCs). It may be difficult to determine which control module is causing the interference. In this case, the above method may be the only way of finding the fault source.

If none of the control modules on the LS-CAN respond but a response is received from the control modules on HS-CAN 

The central electronic module (CEM) protects the CAN network from short-circuits caused by the data connection device. This is achieved with the aid of four internal relays, one for each CAN cable. The relays are closed when the central electronic module (CEM) receives a signal from VIDA on the communication cable.

If the above problem occurs, check the following:

1. The VCT2000 cable. This cable has given problems before. Try with a different cable and a different VCT2000
2. Continuity and signal level on the communication cable
3. Continuity and signal level in the CAN cables between the connector and the central electrical module (CEM).

If points one to three do not produce a result, the fault is probably a permanent cable fault in the CAN network or in a control module. Continue fault-tracing according to "CAN network hardware and measurement methods" below.

CAN network hardware and measurement methods 

The CAN network is connected using resistors (120 Ω each) between the two CAN cables (green (GN) for CAN-L, white (W) for CAN-H) in some control modules. The two control modules in the low speed network (in principle the passenger compartment) that have resistors are the rear electronic module (REM) and the upper electronic module (UEM). In the high speed network (in principle the engine compartment), the position of resistors depends on the engine type and model year. For model years 99-01, the resistors are positioned in the anti-lock brake system module/brake control module (ABS/BCM) and the electronic throttle module (ETM). In cars from model year 02 with Bosch EMS, the electronic throttle module (ETM) is no longer part of the CAN network. The resistor in this case is located in the engine control module (ECM).

Measurement method 

To localize a permanent fault in the CAN network, the resistance can be measured in the network. When taking resistance readings, the battery negative terminal must be disconnected and the resistance must be close to 60 Ω. An open-circuit in one or both CAN cables will produce a resistance of 120 Ω. The recommended approach is to measure the resistance using a breakout box connected to the central electronic module (CEM). This has the following advantages:

1. The reading is taken with the central electronic module (CEM) connected. Note that open-circuits in the anti-lock brake system module/brake control module (ABS/BCM), steering wheel angle sensor module (SAS), power seat module (PSM), passenger door module (PDM), driver's door module (DDM) audio module (AUM) will not affect the reading as these control modules are not connected in series. The reading only checks the "main artery in the CAN network". However, a short-circuit between the two cables will be detected
2. There is easy access to the low speed network, the high speed network and the cables between the central electronic module (CEM) and the connector
3. If a multimeter is connected, this can be positioned in front of the driver's seat and the cable harness/connectors can be twisted above the central electronic module (CEM). It is then easy to, see any changes in resistance
4. As in point 3, twist and turn the cables/junction behind the radio where the cables lie against the rear wall of the engine compartment
5. As in point 3, move the cables/junction connected to the cable harness in the headlining by the A-post
6. As in point 3, ask someone to twist and turn the cables under the cooling box for the central electronic module (CEM) and the transmission control module (TCM).

If for some reason it is not possible to use the breakout box for the central electronic module (CEM), the low speed network can be measured using the breakout box for the power seat module (PSM) or in its connector when the power seat module (PSM) is disconnected.

These measurements are particularly effective when diagnostic trouble codes (DTCs) CEM-1A51 to 1A66 and E003 or E001 are stored without diagnostic trouble codes (DTCs) CEM-DF03 to DF16 being stored. When taking resistance readings, also check that none of the cables are short-circuited to ground or voltage, which ought to have stored CEM-DF03 to DF16. The resistance should be several kΩ.

For intermittent faults, the oscilloscope is very useful. The reading should be taken with all control modules connected and powered up using the breakout box. Check that the voltage on CAN-H never exceeds 4.5 V and that CAN-L is never below than 0.5 V. Note that the oscilloscope in VIDA is not sufficiently accurate (measurement speed too low) for detailed measurement of the traffic on the CAN network, but can give an indication of the voltage levels that exist and whether communication exists or not.