Corrupt CEM Non Start Investigation and Repair Tutorial

[brbrob]

Do you have any tools? Dice?

If you have dice you don't need teensy or io terminal

I have a Top Don J2534, a Chinese ScanMatik Dice Unit, VIDA, OBDII Breakout Box, Oscilliscope, CEM Wiring Diagram, soldering capabilities, willingness to learn .

I have a pretty extensive hobby garage with most everything needed. I have a Computer Science background.

Here is the readout from VIDA
CEM-ID Code Received: Yes
CEM-ID Code Stored: OK
CEM-Random Code to TP: Yes
CEM-Response from TP: Yes
CEM-Key Type: Main Key
CEM-Key Number: 2
CEM-Number of Keys: 4
CEM-Immobilizer engine, checking control module: OK
CEM-TP Status OK: NO
CEM-Immobilizer, start permitted: START NOT APPROVED

TP STATUS OK
Shows if all of the following conditions are fulfilled: 1) Key code (transponder ID-code) is stored. 2) The key has the own vehicle's security code (the key belongs to the vehicle). 3) Communication (random code and response) is OK.
YES=all above conditions are fulfilled.
NO=any of the above conditions is not fulfilled.

So if I am understanding correctly the CEM and Key are communicating properly however the random code and response handshake is failing.

It is also worth noting that the car was previously working with the primary key I am diagnosing with. It stopped working after a leak in the sunroof drain caused water buildup on the drivers side floor and fried the HCM. I have since replaced the HCM. The leak also seemed to cause some damage to the CEM top board (Pictures Here: https://drive.google.com/drive/folders/ ... sp=sharing). I did replace the capacitors and Can Bus transceivers. The CAN BUS Receivers where replaced with the newer revision from same chip manufacturer.

[Dudde]

I have a Top Don J2534, a Chinese ScanMatik Dice Unit, VIDA, OBDII Breakout Box, Oscilliscope, CEM Wiring Diagram, soldering capabilities, willingness to learn .

I have a pretty extensive hobby garage with most everything needed. I have a Computer Science background.

Here is the readout from VIDA
CEM-ID Code Received: Yes
CEM-ID Code Stored: OK
CEM-Random Code to TP: Yes
CEM-Response from TP: Yes
CEM-Key Type: Main Key
CEM-Key Number: 2
CEM-Number of Keys: 4
CEM-Immobilizer engine, checking control module: OK
CEM-TP Status OK: NO
CEM-Immobilizer, start permitted: START NOT APPROVED

TP STATUS OK
Shows if all of the following conditions are fulfilled: 1) Key code (transponder ID-code) is stored. 2) The key has the own vehicle's security code (the key belongs to the vehicle). 3) Communication (random code and response) is OK.
YES=all above conditions are fulfilled.
NO=any of the above conditions is not fulfilled.

So if I am understanding correctly the CEM and Key are communicating properly however the random code and response handshake is failing.

It is also worth noting that the car was previously working with the primary key I am diagnosing with. It stopped working after a leak in the sunroof drain caused water buildup on the drivers side floor and fried the HCM. I have since replaced the HCM. The leak also seemed to cause some damage to the CEM top board (Pictures Here: https://drive.google.com/drive/folders/ ... sp=sharing). I did replace the capacitors and Can Bus transceivers. The CAN BUS Receivers where replaced with the newer revision from same chip manufacturer.

Do you have the eeprom and flash files?
I would guess the sync between CEM and ECM is corrupt

[dikidera]

Is this a case of bit flips? Perhaps a cosmic ray struck exactly where it needed to?

[brbrob]

Do you have the eeprom and flash files?

I do not. If my research is correct I will need to purchase an EEProm Reader/Programmer compatible with Motorola/Freescale MC9S12DG256CPV chip. So far I have narrowed down to XHorse VVII Pro or Orange5. Do you have experience with either of these or recommend a different tool?

[brbrob]

Is this a case of bit flips? Perhaps a cosmic ray struck exactly where it needed to?

To be determined. The car god's have not been kind to me this year. Have a different vehicle that decided to go haywire after jump starting it. Considering getting a horse and buggy.

[Dudde]

Do you have the eeprom and flash files?

I do not. If my research is correct I will need to purchase an EEProm Reader/Programmer compatible with Motorola/Freescale MC9S12DG256CPV chip. So far I have narrowed down to XHorse VVII Pro or Orange5. Do you have experience with either of these or recommend a different tool?

Of you have ordered the io terminal you can read the eeprom and flash over obd

[vtl]

Considering getting a horse and buggy.

Horse? You will be disappointed by a huge reliability drop, even in comparison with 20 years old Volvo

[brbrob]

I sent the CEM, ECM, and two keys to Xemodex.
They ended up replacing the CEM and programming it from my original.

Xemodex notes on the original CEM I sent:
The original CEM has communication, has been tampered - 3rd party has been in unit, it is water damaged, and the wipers are faulty. The CEM, ECM and Key are all working together. We cannot test for no start/crank issue outside of the vehicle. The immobilizer test did pass in VIDA on our test bed.

I have installed the Xemodex CEM into the vehicle and still have crank / no start condition.

The immobilizer status remains the same as previously.
CEM-TP Status OK: No
CEM-Immobilizer, start permitted: Start Not Approved

So with the Xemodex module installed now I can most likely rule out it being a Hardware fault.

The Teensy 4.1 package arrived.
Guess I will invest in a programmer and check software.
Perhaps there is a possibility of a wiring issue?

[vtl]

Perhaps you need to sync ECM with your CEM.

[brbrob]

Wouldn't Xemodex have already done that as I sent them the ECM, CEM, and two keys?