XC40 CEM pinout & canbus

[rachas]

Hi Guys,

I am new to this forum and sorry if this question repeats, but I could not find the answer. OK let start from beginning. I have Volvo XC40 2021/2022 - CEM - 32268108 AB -> SPC 5748G (Power Arch) on my garage bench, but I believe this same CEM goes to XC60 and others. I am trying to connect to this CEM via CAN bus and play around just for my curiosity. Straight away I have faced the issue.

OK let explain, what I did and trying to do. I found on internet this electrical wiring manual MC-10236765-9999.pdf and figured out that I need use those pins to connect to power it the CEM:


NOTE: because of thread has limitation I have to split my message in parts.

---

Code:

12V possitive

--30--> Constant power from the battery

Power_supply_KL30A - PO1 -> SA1011C 2TBD 6.0 RD
Power_supply_KL30B - PO2 -> SA1012C 2TBD 6.0 RD/YE

--15--> Contact remains connected during start

IgnitionPowerRelayFB - EN9 -> SG1017B 2TBD 0.35 BU/GN

12V negative

El1_GND - FL64
EL2_GND - FL65

--CanBus-- 500kpbs

CANHS+ - FL20 -> CG1401AA 2TBD 0.35 VT/WH
CANHS- - FL19 -> CH1402AA 2TBD 0.35 VT/GN

---

Attaching screenshot of my findings (page 9, 10, 15 & 19).

Once I power the CEM I see traffic on the CAN bus, but I can not get response back from a CEM, when I do send messages like:

Code:

7DF 023E800000000000 -> Tester present with functional id
7DF 0210820000000000 -> Extended session with functional id
726 0322F19000000000 -> Show VIN
726 0210020000000000 -> Start Session

What I see on Can Bus, like this going in the loop:

---

Code:

0E3   [8]  E0 00 00 00 00 00 00 00
5AC   [8]  0D 00 00 00 00 00 00 00
57F   [4]  10 09 C0 00
020   [8]  CF BC C9 C0 10 12 20 0F
032   [8]  00 00 00 00 00 00 1B 20
033   [8]  00 00 00 00 00 00 07 D0
035   [8]  00 00 00 00 00 00 10 00
038   [8]  00 00 00 00 00 00 05 00
03A   [8]  00 00 00 00 00 00 00 00
053   [8]  00 00 00 00 00 00 00 00
0B0   [8]  00 00 00 00 55 00 20 02
100   [8]  00 85 00 5B 69 00 0D 06
120   [8]  3C 00 00 00 00 00 1C 00
189   [8]  00 00 00 00 00 00 00 00
200   [8]  00 00 00 00 01 80 00 00
210   [8]  5A 03 32 00 00 00 00 00
215   [8]  00 00 00 00 00 00 00 01
220   [8]  00 00 00 00 00 00 00 00
340   [8]  39 00 00 00 00 00 00 00
360   [8]  02 56 31 4D 32 34 34 39
380   [8]  01 F4 01 2C A8 00 00 1C
040   [8]  00 00 20 40 40 15 60 00
05A   [8]  FF 05 00 00 80 00 09 04
020   [8]  CF 3C C9 C0 10 12 20 0E
032   [8]  00 00 00 00 00 00 1B 20
033   [8]  00 00 00 00 00 00 07 D0
035   [8]  00 00 00 00 00 00 10 00
038   [8]  00 00 00 00 00 00 05 00
03A   [8]  00 00 00 00 00 00 00 00
5AC   [8]  0C 00 00 00 00 00 00 00

---

and because I am not sure if on new CMA/SPA cars on CAN Bus system CEM still address called canIdTX - 72E, canIdRX - 726, that is why I did used all addresses from 0x70[0-7] to 0x7F[0-7] to test, but still with no luck get response.

I know that if you want go diagnostics on the XC40 you need press Start/Stop button for 5 sec.
Here it comes my question. When you press button for 5 sec is CEM goes to some kind diagnostic mode, like some pin gets additional 12V+ of power? Or might on CAN bus some module like VCM sends specific message like: (7DF 023E800000000000 -> Tester present etc?)? Or I might missing some additional power connection to CEM to get CEM work properly?

I understand I ask difficult questions, but I believe there are lot of clever people on this forum than me [img]data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7[/img] and they can direct me to correct way. Thank you in advance for any answer.

Regards,

Rachas

---

Attaching the pics.

[IMAY2023]

Pressing and holding the "turn on" switch 5 sec without pressing the break, puts the car into ignition 2 stage.  
When you power on the CEM, it will send many messages and some of those massages are requests from other ECUs such as VCM, BSM, ECM and so on. If it does not get the correct reply, it does not start many internal components. 

Regarding the message IDs. starting from 600 and up, they are all diagnostic message IDs. higher the message ID lower the priority.  None of the internal regular messages between the ECUs use those high message IDs.