W203 A209 Engine Can C simple testing - Voltages

[hofnerpres1]

2006 CLK Kompressor - intermittent no start fault. I and others have "solved" this problem a number of times. The fault has the genius property of going away once a component has been changed and money has been spent. It's just done it again after replacing the ECM with a good cloned spare. Key goes in, key coil is energised - no steering lock movement ( brand new unit professionally replaced by last victim along with the EIS ). No key turn. Time to dig deeper. The fast engine CAN C is a Green/Green & White twisted pair and the digital signal and carry voltages are generated by the EIS. The factory WIS wiring diagram shows that the ECM and each module is directly connected to the CAN junction bus X63/4 ie GN/GNWH - these twisted pairs can be seen coming from all main control lumps around the car - they disappear into the wiring harness but none go through any connectors or SAMs on the way to this common junction. ( There is a second GN/GNWH pair coming from the rear ECM top multiplug and not shown on the wiring diagrams - another mystery - the pair in the front plug check out ) The EIS feeds the engine CAN C junction over a short wire pair and so supplies the system distribution bus X63/4. Mercedes tuck it away in the RHS cill channel (UK RHD cars) by the accelerator pedal - It's a bulky 100mm long double row black thing. It can be wiggled out to get better access but knee pads and extra lights will be needed. This now gives you access to do some basic testing with a simple multimeter ( see several helpful Youtube videos). It would be nice to see each pair labelled but the factory was clearly too busy. The odd one out is a three pin plug which also carries an earth - this goes to the ECM. Check the earth. Take a plug and test for voltages - you should be seeing 2.65v Can High GN and 2.35v Can Low GN/WH - the car needs to be awake - putting the key in will do that even if it doesn't turn. By leaving the EIS feed plugged in and removing the rest individually you might get lucky and be able to hear the steering lock activate as you remove a bad module connection. I think this car has stumped previous technicians since all the basic checks look good - Continuities, resistances and grounds all check out. We have one anomaly - As the EIS is plugged into the X63/4 bus block the voltages even up to 2.5v and 2.5v - odd. Plug in the ECM and now we have 1.6v and 1.6v ! Plug in the rest and each one brings it down to 0.8v - fascinating. I know what you're thinking - bad wires between the EIS supply and the Bus - voltage drop. Once again - not that simple. Get a back probe in the output from the EIS and both voltages fall together - the drop is on the whole system. Looks like we have a resistive short on the ECM or it's circuit somewhere. Found Larsk84 had a similar problem on the Scanner Danner forum but his W211 has a separate gateway module which simplifies matters a little. Looks like we know where to aim now. More digging tomorrow.

 

[Tony Dyson]

... - Continuities, resistances and grounds all check out...

Are the resistances you refer to above the 120 Ω EOL CAN C resistances, how did you test them and what readings did you get?

 

[supernoodle]

Forget messing with multimeters for CAN, get yourself a Picoscope for £100. Check out mechanical mindset on YouTube for some good vids on how to use it too.

 

[hofnerpres1]

Thanks for the replies. I was about to order a scope when I found the voltage drops and will probably invest once we sort out the bad wires. I've seen all the videos and was hoping to remain an amused spectator rather that a Dannerwannabe . The CAN circuit resistances all come up with the correct 60 ohm result but that's just a quick meter test which doesn't load the circuit. I will be digging deeper today with proper voltage drop testing and probably try a bypass line over that suspect ECM Can connection. Top Tip - If anyone is into radio control then you will find a mini 2 pin female 1s lipo connector fits perfectly into a spare socket on the X63/4 engine can junction. This gives easy access for testing and measurements.

 

[Tony Dyson]

I had a Picoscope around the mid '90's while doing some video work, I liked the idea in principal but I struggled with it in the end due to poor sampling rates, I imagine they've improved since then though.

 

[supernoodle]

For lab use a bench scope is still best but for automotive use even £100 pico is more than up to the job. The highest frequencies you'll probably come across are the 1khz signals used on H bridge devices like turbo and EGR. As you get more capable or just like tinkering, the 4 channel may be better, but that's quite a step up in price.
They do automotive versions, but they aren't necessary for the casual user.
One great feature is that the software has the ability to decode serial signals like CAN and SENT too.

 

[hofnerpres1]

Meanwhile, back at the coal face..... Checked all the can lines to the ecm and other modules - about 1.5 ohms line resistance was the worst result. Wiggled and prodded the harnesses and tested the can feeds for shorts to earth etc - all come out perfect. The fact that the system is good is strongly supported by the fact that when the engine runs there has never been a hint of a problem or any idiot lights. I'm chasing a red herring here - there are no shorts. What is very apparent is that the 2.5 v feed coming from the EIS before the key turns is not a proper feed but merely a small output from the internal circuitry which will not switch to a proper feed until the key is allowed to turn by the security code handshake. This is born out by the fact that whatever module is plugged into the can junction, the voltage is pulled down significantly - they cannot all be shorted. I tried every combination. So can anyone explain exactly how the key release logic works please. I thought the EIS sent a coded signal to the ECM which then sent a signal to enable key turn and this was done over the Can C system. Is it done some other way or does the key simply talk to the EIS which then releases and the ECM then enables the start relay. This would imply my new and twice tested EIS is still the problem. Anyone able to educate ?

 

[LostKiwi]

Are you getting CAN errors on any modules?
MB error logging is very good in that respect.

 

[hofnerpres1]

Hi Lost Kiwi ( I see you can visit home again now ! ). In answer to your question this car has never recorded any faults of any kind or thrown a MIL. I "jump" started it again yesterday - no faults. I have the MB icarsoft and the CR max ( very happy with these ). Every module gives off all the correct start enable messages. The gearbox interlock cable is new and correctly fitted, The Transmission shifter has been rebuilt and tells the ECM it's happy. It seems the EIS only fully activates the engine CAN C signals when the key is turned. It won't allow that. I understand CAN B and the Radio system handle the wake up routine which is activated when the door is opened. We can scan, scope and measure all day but until the system is fully understood I'm working in the dark. It's already baffled one German car specialist and an experienced auto electronic guy who specialises in Mercedes so I.m reluctant to keep throwing money at people who are more baffled than I am..... Previous owner spent £1200 on new EIS and Steering Lock. No such thing as a cheap old classic.

 

[supernoodle]

Checking voltages on anything other than an analogue or digital signal won't really tell you anything. Yes, the net will tell you you can do a voltage check on a CAN bus, but all that's good for is confirming if it's dead or alive. But as your car works most of the time and you have no faults, you know its working.

As LK said, MB and others will report errors if any module goes off bus.
If module B knows it should see data from module C, module B will periodically check for the reception of a golden message. This golden message is one that is known will be sent regardless when the system is powered up. If message is not seen, a missing comms with module C error will be set.
Every module that interfaces with module C would do the same.
It repeats around the network, so you can easily see where an error lies.

It's important to understand the errors you haven't got either. I guess when you put the key in several modules do a little handshake to agree the key is recognised, key can turn and everything is good to go. EIS I guess must be initiator if the process, so if it doesn't get a response from one of the other modules, wouldn't it throw an error? If you've no errors there that suggests the process hasn't been initiated.

Going back to a comment you made

We can scan, scope and measure all day but until the system is fully understood I'm working in the dark.

That's exactly how you reverse engineer something. Analyse a system when it's working, so when it stops working you know what's missing. But use the right tools, a mulimeter won't cut it.

 

[LostKiwi]

Does this help?

WIS 80.57 Drive Authorization System - W220 S-Class Encyclopedia

w220.wiki

 

[hofnerpres1]

Thanks Supernoodle - I agree with everything you say - I'm looking to buy a scope but a factory diagnostic tool might be more relevant for this car at the moment since I would be trying to get readings from a dead circuit. It's beginning to look like the EIS again and I can't reverse engineer that box of tricks without much more advanced kit ( and a better understanding) What we can do is get it tested which seems a sensible quick and cheap step before we dive ever deeper into my wallet.

 

[supernoodle]

Does this help?

WIS 80.57 Drive Authorization System - W220 S-Class Encyclopedia

w220.wiki

That's some proper reverse engineering.
Good find.

 

[hofnerpres1]

Lost Kiwi - You are a prince amongst men. I was awakened at 7.30am this morning by the white van guys wanting to deliver my new mattress - they had already done three deliveries ! Thanks to you I now have the perfect excuse to retire early with some excellent reading material. The shop did try and sell me the fancy articulated version which runs on two motors controlled by a wireless remote connected to a central computer module. I leave you to imagine my reply.....

 

[hofnerpres1]

Well once again the EIS was tested on the bench and performed perfectly. It's files were copied over to my good spare and so we now have a spare EIS. There was a hope that this unit might perform differently but sadly not - the fault must be somewhere else. My scope has arrived and the Can results look faultless once the ignition is enabled ie the ESL Emulator lets the key get to position 2. In an effort to avoid having to hack off a brand new steering lock ESL I got out all the wiring diagrams and tested every continuity on every wire connected to the EIS, ECM avd ESL. Also feeds and grounds. It's all good. Also ran a bypass lead from Can C at the EIS to ECM - No change. I'm led to the following conclusions.

1. Dealing with old electronics and second hand components is the road to hell. Even these parts from Mercedes are not new and are crazy expensive. A " Reconditioned Electronic Component" is meaningless unless every MCU chip, Mosfet, and capacitor on that board has been renewed. When the fault is not obvious a definitive diagnosis will take some expensive equipment and some expensive time from a really knowledgeable technician. This fault has beaten several of these.

2. When the replacement ECM was cloned the car failed to start and the baffled Auto Tech said that the fault seems to have carried over with the files. Having found nothing else wrong I suspect he was correct. Maybe we are looking at some corrupted coding. Frankly I'm past caring. Have a look at the sort of cars that are going to the recycling yards - lovely condition but the cost of sorting out the control systems have killed 'em.

3. Car is low mileage and mint so back to plan B. Fit a proper automotive starter button to give the starter 12v and hide it in the cabin for a nice security feature. Get another ESL emulator to go in my ultimate W203 accessory pack ie a box containing spare Front SAM, spare Rear SAM, Spare ECM and spare EIS.

4. Thanks for all your help guys. It's not been all negative. The iCarsoft CR Max has already sorted out two family cars. I'm so fast on ASRA and WIS now that the local parts guys have threatened me with a job. I now know how modern cars operate which means my next shopping car will be leased and the summer toy will be a W124 or older. Off to sort the ESL now - pass the chisel.....

 

[hofnerpres1]

Success. Starter button ended up on the dash. It's a hefty 25 amp but small and flush fitting and only you lot might notice it's not original. Getting good access to Dremel-off the Steering Lock was a pain. To remove the panel below the steering wheel means first removing Heater controls, Upper Center Control Unit, Radio, Gear lever and cover, Centre armrest and storage assembly, Light switch, EIS. You will also have to remove the Instrument Module since some genius hid two screws underneath. Fortunately there is a clever hooked tool which renders this removal very simple - it can be copied using clothes hanger wire - see the helpful Pelican Parts video. The same genius hid a screw under the parking brake release handle which goes into the Light Switch module - laugh out loud silly. Another tip is to be careful not to mix up the various screws. The coarse thread ones go into plastic and the finer threaded ones go into the nasty metal spring clips. Typical cheap and nasty modern car practice. The comically weak mounting for the hand brake release frame had broken and pulled away so it was all just dangling. A 3mm thick piece of hardwood was glued to the front side which took two countersink replacement screws and restored sanity. Indian Rosewood from my guitar making scrap pile but 3 ply marine ply would do nicely. A diamond rotary cutter on a Dremel made short work of the ESL - just cut at the rivet pins then lever the cover off. Resist the strong temptation to enjoy smashing it with a sledge hammer since you can remove the electrical socket from the circuit board. Solder this neatly to your new ESL Emulator such that it will now plug in neatly to the connector plug from the EIS - Use plenty of heatshrink on the wiring and cable tie it all neatly out of the way. I used a unit from ECUSERVICES in Poland - nice quality. On the W203 it's cheap and plug and play. Later models need coding. You still need the correct key so the car is secure but more likely not to leave you stranded. Amen. Moving back now to see why this car hates the new MAF from FEBI. "Just when you think you're free it pulls you back in...."