Part 2

Information about the CAN network, structure and function

Limp-home modes and characteristics of control modules in the event of faults in the CAN network
When a control module cannot receive messages from the central electronic module (CEM) it will go into Limp-home mode. In such cases, the control module can retain part of its functionality. The remaining functionality varies in different control modules. If a fault occurs after a control module has been started up, it will normally retain the most recent values as the Limp-home values. There are exceptions, such as the fuel gauge in the driver information module (DIM).
Some clear examples for the low speed side network:
- Driver information module (DIM):
As the driver information module (DIM) only displays signals received from the CAN network, it will soon be evident if signals are lost. The display of various signals will disappear at slightly different times due to some filtering of the signals in the driver information module (DIM). The values on the gauges are normally frozen for around ten seconds before dropping to zero and the driver information module (DIM) shuts down. If only one control module has disappeared from the network, the driver information module (DIM) can display the first indication of this. An example of this is where the rear electronic module (REM) stops communicating, which is indicated by the fuel gauge dropping to zero
- Climate control module (CCM):
This control module must retain some of its functionality even if the CAN communication is lost. It is also a very good indication of whether the CAN communication has been lost, as the LEDs will light up exactly ten seconds after the ignition key has been turned to positions one or two. Other symptoms: if the AC compressor is not working, apart from the first second when the function is checked by the engine control module (ECM), this can indicate a fault in the climate control module (CCM)>central electronic module (CEM)>engine control module (ECM) chain. Another very obvious symptom is that the blower fan continues to operate for up to ten minutes after the key is removed from the ignition switch. This is because the climate control module (CCM) is powered via Extended-X from the central electronic module (CEM). The climate control module (CCM) normally switches off the blower fan and other functions when it does not receive a signal over the CAN network after the ignition key has been removed. If there is no CAN communication, the climate control module (CCM) will continue to operate until the central electronic module (CEM) switches off the power supply
- Driver door module (DDM)/Passenger door module (PDM):
The module will be set to a resting mode and no functions will be performed, such as setting the mirror or operating the power windows
- Power seat module (PSM):
The memory function in the seat will not work. Stored positions for seats and mirrors will not work when the car is unlocked with a remote control
- Upper electronic module (UEM):
The seat belt reminder will be lit, even though the belt is secured in the seat belt buckle. It will not be possible to lock or unlock the car using the remote control
- Audio module (AUM):
The radio retains most of its functionality. However, the buttons on the steering wheel will not work
- Rear electronic module (REM):
The fuel gauge is not working and it will not be possible to lock/unlock the rear doors using the central locking switch. The heating loops in the rear windshield and the rear folding head restraints will not work
- Steering wheel angle sensor module (SAS):
The anti-skid system will not work
- Steering wheel module (SWM):
Buttons on the steering wheel and the turn signal lamp stalk will not work. However the horn will still work because it is connected directly to the central electronic module (CEM).

Some clear examples for the high speed network:
- Engines:
Cannot be started as a result of no communication between the central electronic module (CEM) and transmission control module (TCM) + engine control module (ECM)
- Electronic throttle module (ETM):
The node has three Limp-home levels:
- Level 1: No cruise control function
- Level 2: Accelerator pedal "heavy". Poor response
- Level 3: Present Limp-home mode. The engine speed (RPM) is controlled via the injectors.
- Transmission control module (TCM):
It is not possible to use all the gears.

Note! If the control module has gone into Limp-home due to an open-circuit in the CAN communication, the functionality will not return during the cycle, even in the event of the fault disappearing.

- Anti-lock brake system module(ABS)/Brake control module (BCM):
The remaining functionality depends on what fault has occurred. In the event of a fault in the AYC sensor, the indicator lamp lights and DSTC stops working. Faults in the wheel sensors cause the indicator lamp to light and the ABS function to disappear, although there is still braking assistance. The unit can lose certain diagnostics in Limp-home mode
- Central electronic module (CEM):
Extremely large loss of function. It is worth noting that the control module has separate circuits for the high speed and low speed networks. This means that it is possible to communicate with the control module via the high speed network even when the low speed network has a fault.

Fault-tracing tips
If the central electronic module (CEM) has stored diagnostic trouble code (DTC) CEM-DF14 CAN low short-circuit to ground, this does notmean that the central electronic module (CEM) is necessarily the control module which short-circuits the cable. The short-circuit may be from any part of the cable to any ground terminal or ground lead. The fault may be in a cable harness, which is the most common situation, or in a control module. Note that the diagnostic trouble code (DTC) can be stored in some control modules but not in others, and that the short-circuit in this case can be far from the control module that stores the diagnostic trouble code (DTC).
Statistically there is a high likelihood of the fault being in the cable harness (check behind the audio module (AUM), at the supplemental restraint system module (SRS), the terminals for the CAN cables in the connectors on the transmission control module (TCM) and the engine control module (ECM). Note that terminal pins (P/N 9441394) can be used to check the mating surface in the female connectors for the CAN cables. If the mating surface is defective or the terminal pins detach too easily, the female connector socket must be replaced (P/N 9442486).
If diagnostic trouble code (DTC) E001 is stored continually and the cable harness is free of faults, all control modules containing diagnostic trouble code (DTC) E001, apart from the central electronic module (CEM), must be disconnected from the CAN network. Delete the diagnostic trouble codes (DTCs) in the remaining control modules and read off diagnostic trouble codes (DTCs) again to see if the fault disappears. Then connect the control modules again, one by one, until the diagnostic trouble code (DTC) recurs. If VIDA can communicate with the car when the ignition key is in position 0 and 1 but not in position 2, the fault is probably in a 15-supplied control module.
The above method can also be used in other scenarios. On rare occasions, control modules can begin sending irrelevant messages on the CAN network. This can prevent the correct messages from getting through. The result can be one or more E003 or CEM-1A51 to 1A66 diagnostic trouble codes (DTCs). It may be difficult to determine which control module is causing the interference. In this case, the above method may be the only way of finding the fault source.

If none of the control modules on the LS-CAN respond but a response is received from the control modules on HS-CAN
The central electronic module (CEM) protects the CAN network from short-circuits caused by the data connection device. This is achieved with the aid of four internal relays, one for each CAN cable. The relays are closed when the central electronic module (CEM) receives a signal from VIDA on the communication cable.
If the above problem occurs, check the following:
1. The VCT2000 cable. This cable has given problems before. Try with a different cable and a different VCT2000
2. Continuity and signal level on the communication cable
3. Continuity and signal level in the CAN cables between the connector and the central electrical module (CEM).
If points one to three do not produce a result, the fault is probably a permanent cable fault in the CAN network or in a control module. Continue fault-tracing according to "CAN network hardware and measurement methods" below.

CAN network hardware and measurement methods
The CAN network is connected using resistors (120 ohms each) between the two CAN cables (green (GN) for CAN-L, white (W) for CAN-H) in some control modules. The two control modules in the low speed network (in principle the passenger compartment) that have resistors are the rear electronic module (REM) and the upper electronic module (UEM). In the high speed network (in principle the engine compartment), the position of resistors depends on the engine type and model year. For model years 99-01, the resistors are positioned in the anti-lock brake system module/brake control module (ABS/BCM) and the electronic throttle module (ETM). In cars from model year 02 with Bosch EMS, the electronic throttle module (ETM) is no longer part of the CAN network. The resistor in this case is located in the engine control module (ECM).

Measurement method
To localize a permanent fault in the CAN network, the resistance can be measured in the network. When taking resistance readings, the battery negative terminal must be disconnected and the resistance must be close to 60 ohms. An open-circuit in one or both CAN cables will produce a resistance of 120 ohms. The recommended approach is to measure the resistance using a breakout box connected to the central electronic module (CEM). This has the following advantages:
1. The reading is taken with the central electronic module (CEM) connected. Note that open-circuits in the anti-lock brake system module/brake control module (ABS/BCM), steering wheel angle sensor module (SAS), power seat module (PSM), passenger door module (PDM), driver's door module (DDM) audio module (AUM) will not affect the reading as these control modules are not connected in series. The reading only checks the "main artery in the CAN network". However, a short-circuit between the two cables will be detected
2. There is easy access to the low speed network, the high speed network and the cables between the central electronic module (CEM) and the connector
3. If a multimeter is connected, this can be positioned in front of the driver's seat and the cable harness/connectors can be twisted above the central electronic module (CEM). It is then easy to see any changes in resistance
4. As in point 3, twist and turn the cables/junction behind the radio where the cables lie against the rear wall of the engine compartment
5. As in point 3, move the cables/junction connected to the cable harness in the headlining by the A-post
6. As in point 3, ask someone to twist and turn the cables under the cooling box for the central electronic module (CEM) and the transmission control module (TCM).
If for some reason it is not possible to use the breakout box for the central electronic module (CEM), the low speed network can be measured using the breakout box for the power seat module (PSM) or in its connector when the power seat module (PSM) is disconnected.
These measurements are particularly effective when diagnostic trouble codes (DTCs) CEM-1A51 to 1A66 and E003 or E001 are stored without diagnostic trouble codes (DTCs) CEM-DF03 to DF16 being stored. When taking resistance readings, also check that none of the cables are short-circuited to ground or voltage, which ought to have stored CEM-DF03 to DF16. The resistance should be several kOhms.
For intermittent faults, the oscilloscope is very useful. The reading should be taken with all control modules connected and powered up using the breakout box. Check that the voltage on CAN-H never exceeds 4.5 V and that CAN-L is never below than 0.5 V. Note that the oscilloscope in VIDA is not sufficiently accurate (measurement speed too low) for detailed measurement of the traffic on the CAN network, but can give an indication of the voltage levels that exist and whether communication exists or not.

Note! Never take readings directly in the connector using the test probes of the multimeter. This can result in damage to the connector and entail insufficient contact when the connector is reassembled. Use a terminal pin instead.