Here's an interesting one we had the other day. The vehicle was towed in as a no crank. The customer also noted that all the lights were illuminated on the dash during KOEO, and the key FOBs wouldn't work.

We performed a code scan and found that only the modules on the Interior High Speed network would respond. I kick myself now, but I missed the opportunity to take a WiTECH screenshot of the inoperative network. Picture something like [this] but all the modules on the left, connected to the black wire, were colored red because they weren't responding.

For those who may not be familiar, here's a brief overview of how this network operates . There are 3 CAN networks working side by side with a gateway (the Totally Integrated Power Module/ TIPM in this case) as the center hub: The Diagnostic CAN-C, CAN-C, and CAN-IHS. The [Diagnostic CAN-C ] is like your standard CAN circuit at pins 6 and 14 of the DLC, except the network only goes from the DLC to the TIPM, and is only used for Module to Scan Tool communication, the other networks are for module to module communication. The TIPM physically and electrically isolates the buses from each other. The CAN-IHS (Interior High Speed) is for "less critical nodes" (body, radio, etc) and the [CAN-C] is used for "more critical nodes" (think powertrain, brakes, airbags).

Since the DLC isn't directly wired to the CAN-C network, in order to check terminating resistance you need to check at one of the modules. With the battery disconnected, we pulled off the ABS connector and found over 100 ohms of resistance between the CAN + and CAN - wires. At this point all I know is that it's not close to 60 ohms, so there's an issue.

Next, I back probed the network wires at the TIPM and scoped a waveform like this during [KOEO]. At first glance it appears like somewhat normal communication, but a closer look shows that the bias voltage is resting near zero instead of 2.5. Here's a shot of the [Diagnostic CAN-C] for reference.

It appears that something is pulling these circuits low, but not low enough to completely eliminate communication attempts. The ABS, PCM, and TIPM are all near each other under the hood, but unplugging them didn't change anything. If you take a look back at the circuit [there's two connectors] that can be unplugged to isolate those portions of the network. We were already right next to [C105] which connects the [Steering, Wireless, and Airbag modules].

Unplugging C105 restored communication with some of the modules. Plugging C105 back in brought down the network again. In this screenshot [the drop is very apparent].

Of the three modules downstream of C105, the WCM and Steering module are the easiest to access as both are mounted to the steering column. Once the column covers were removed it was apparent that someone had had been monkeying around in there. [WCM]. A [closer shot] shows that both the CAN + and CAN - wires at the WCM connector have been piggybacked for an aftermarket alarm. Unplugging the aftermarket module let the vehicle start and restored communication between all of the modules. My co-worker said afterwards that the module appeared to have gotten wet and had a nice electrical burn smell to it.

A friend of mine works for one of those very same aftermarkets. He tells me that they'll tap into the bus in order to send Lock, Unlock, etc messages over the network. Maybe for your next no crank no comm issue you might want to consider sticking your head under the dash to look for one of those modules.

Morgan from Minnesota

Files Referenced: