+- OrBit Forums (https://forums.spaycetech.com)
+-- Forum: Configuration Items (https://forums.spaycetech.com/forumdisplay.php?fid=3)
+--- Forum: Misc (https://forums.spaycetech.com/forumdisplay.php?fid=16)
+--- Thread: XC40 CEM pinout & canbus (/showthread.php?tid=647)
XC40 CEM pinout & canbus - rachas - 11-08-2024
Hi Guys,
I am new to this forum and sorry if this question repeats, but I could not find the answer. OK let start from beginning. I have Volvo XC40 2021/2022 - CEM - 32268108 AB -> SPC 5748G (Power Arch) on my garage bench, but I believe this same CEM goes to XC60 and others. I am trying to connect to this CEM via CAN bus and play around just for my curiosity. Straight away I have faced the issue.
OK let explain, what I did and trying to do. I found on internet this electrical wiring manual MC-10236765-9999.pdf and figured out that I need use those pins to connect to power it the CEM:
NOTE: because of thread has limitation I have to split my message in parts.
Code:
12V possitive
--30--> Constant power from the battery
Power_supply_KL30A - PO1 -> SA1011C 2TBD 6.0 RD
Power_supply_KL30B - PO2 -> SA1012C 2TBD 6.0 RD/YE
--15--> Contact remains connected during start
IgnitionPowerRelayFB - EN9 -> SG1017B 2TBD 0.35 BU/GN
12V negative
El1_GND - FL64
EL2_GND - FL65
--CanBus-- 500kpbs
CANHS+ - FL20 -> CG1401AA 2TBD 0.35 VT/WH
CANHS- - FL19 -> CH1402AA 2TBD 0.35 VT/GNAttaching screenshot of my findings (page 9, 10, 15 & 19).
Once I power the CEM I see traffic on the CAN bus, but I can not get response back from a CEM, when I do send messages like:
Code:
7DF 023E800000000000 -> Tester present with functional id
7DF 0210820000000000 -> Extended session with functional id
726 0322F19000000000 -> Show VIN
726 0210020000000000 -> Start SessionWhat I see on Can Bus, like this going in the loop:
Code:
0E3 [8] E0 00 00 00 00 00 00 00
5AC [8] 0D 00 00 00 00 00 00 00
57F [4] 10 09 C0 00
020 [8] CF BC C9 C0 10 12 20 0F
032 [8] 00 00 00 00 00 00 1B 20
033 [8] 00 00 00 00 00 00 07 D0
035 [8] 00 00 00 00 00 00 10 00
038 [8] 00 00 00 00 00 00 05 00
03A [8] 00 00 00 00 00 00 00 00
053 [8] 00 00 00 00 00 00 00 00
0B0 [8] 00 00 00 00 55 00 20 02
100 [8] 00 85 00 5B 69 00 0D 06
120 [8] 3C 00 00 00 00 00 1C 00
189 [8] 00 00 00 00 00 00 00 00
200 [8] 00 00 00 00 01 80 00 00
210 [8] 5A 03 32 00 00 00 00 00
215 [8] 00 00 00 00 00 00 00 01
220 [8] 00 00 00 00 00 00 00 00
340 [8] 39 00 00 00 00 00 00 00
360 [8] 02 56 31 4D 32 34 34 39
380 [8] 01 F4 01 2C A8 00 00 1C
040 [8] 00 00 20 40 40 15 60 00
05A [8] FF 05 00 00 80 00 09 04
020 [8] CF 3C C9 C0 10 12 20 0E
032 [8] 00 00 00 00 00 00 1B 20
033 [8] 00 00 00 00 00 00 07 D0
035 [8] 00 00 00 00 00 00 10 00
038 [8] 00 00 00 00 00 00 05 00
03A [8] 00 00 00 00 00 00 00 00
5AC [8] 0C 00 00 00 00 00 00 00and because I am not sure if on new CMA/SPA cars on CAN Bus system CEM still address called canIdTX - 72E, canIdRX - 726, that is why I did used all addresses from 0x70[0-7] to 0x7F[0-7] to test, but still with no luck get response.
I know that if you want go diagnostics on the XC40 you need press Start/Stop button for 5 sec.
Here it comes my question. When you press button for 5 sec is CEM goes to some kind diagnostic mode, like some pin gets additional 12V+ of power? Or might on CAN bus some module like VCM sends specific message like: (7DF 023E800000000000 -> Tester present etc?)? Or I might missing some additional power connection to CEM to get CEM work properly?
I understand I ask difficult questions, but I believe there are lot of clever people on this forum than me [img]data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7[/img] and they can direct me to correct way. Thank you in advance for any answer.
Regards,
Rachas
Attaching the pics.
RE: XC40 CEM pinout & canbus - IMAY2023 - 11-09-2024
Pressing and holding the "turn on" switch 5 sec without pressing the break, puts the car into ignition 2 stage.
When you power on the CEM, it will send many messages and some of those massages are requests from other ECUs such as VCM, BSM, ECM and so on. If it does not get the correct reply, it does not start many internal components.
Regarding the message IDs. starting from 600 and up, they are all diagnostic message IDs. higher the message ID lower the priority. None of the internal regular messages between the ECUs use those high message IDs.
RE: XC40 CEM pinout & canbus - rachas - 01-29-2025
Hi again,
Thank you IMAY2023 for your reply.
I’m still looking into this issue and I’ve learnt that Volvo diagnostics has transitioned the CAN bus arbitration ID's from 11-bit to 29-bit. Am I correct?
For example like V40, the diagnostics was running on 11-bit IDs:
CEM:
canIdRX: 0x726 canIdTX: 0x72E
ECM:
canIdRX: 0x7E0 canIdTX: 0x7E8
canIdFunc: 0x7DF
Now like example XC60, I am finding on 29-bit IDs:
CEM:
canId: 0x1A01
ECM:
canId: 0x1630
canIdFunc: 0x1FFF
Am I correct?
RE: XC40 CEM pinout & canbus - IMAY2023 - 01-30-2025
(01-29-2025, 02:56 PM)rachas Wrote: Hi again,
Thank you IMAY2023 for your reply.
I’m still looking into this issue and I’ve learnt that Volvo diagnostics has transitioned the CAN bus arbitration ID's from 11-bit to 29-bit. Am I correct?
For example like V40, the diagnostics was running on 11-bit IDs:
CEM:
canIdRX: 0x726 canIdTX: 0x72E
ECM:
canIdRX: 0x7E0 canIdTX: 0x7E8
canIdFunc: 0x7DF
Now like example XC60, I am finding on 29-bit IDs:
CEM:
canId: 0x1A01
ECM:
canId: 0x1630
canIdFunc: 0x1FFF
Am I correct?
Well, Volvo has changed everything since the SPA models including the message IDs.
Yes, you are correct, here is the complete list of the IDs.
Here are two samples of massage IDs, lowest (highest priority) and highest (lowest priority) But those CanIds do not match to the message Id in the canbus massage.
0x010 8 0D 33 09 94 7F 08 80 00
0x5AC 8 02 0D 01 11 00 06 06 00
If you know how to find the below CANids in the Canbus massage please let me know.
Or the message ID that controls the climate control.
VCM (1001)
IHU (1201)
TVM (1202)
AUD (1212)
PAC (1221)
RML (1416)
WAM (1431)
SODL (1432)
SODR (1433)
VDDM (1601)
PSCM (1612)
SUM (1614)
SCL (1615)
SAS (1616)
ECM (1630)
BCM (1631)
TCM (1632)
EGSM (1633)
OBC (1634)
BECM (1635)
IGM (1636)
IEM (1637)
DEM (1638)
OFM (1639)
ESM (163A)
TACM (163C)
NRCM (163D)
GSM (1661)
DIM (1801)
HUD (1841)
CEM (1A01)
CCM (1A11)
DDM (1A12)
PDM (1A13)
PSMD (1A14)
POT (1A15)
TRM (1A17)
PSMP (1A1A)
OHC (1B22)
BBS (1B51)
IMS (1B52)
BMS (1B61)
SWM (1B91)
HCML (1BB3)
HCMR (1BB4)
SRS (1C01)
RE: XC40 CEM pinout & canbus - rachas - 02-11-2025
OK looks that the diagnostics has been moved to the FlexRay bus.
RE: XC40 CEM pinout & canbus - IMAY2023 - 02-11-2025
Quote:OK looks that the diagnostics has been moved to the FlexRay bus.
No, there is still 500kbps canbus network on the OBD2 port. But they changed how it operates. There are no messages until a generic diagnostic tool initiates a diagnostic session.
RE: XC40 CEM pinout & canbus - rachas - 02-17-2025
Excellent news if diagnostic still on CAN bus
IMAY2023 do you know how diagnostic tool initiates a diagnostic session? What kind of combination does it send?
Or you might have captured diagnostic session on CAN bus somehow and you can share it, please?
RE: XC40 CEM pinout & canbus - IMAY2023 - 02-17-2025
You can buy a $250 diag tool and get everything you need.
What are you trying to achieve?