jg.abaitua

Have been looking, deleting DTCs and waiting for them to return.

And they're the same that have been showing since i acquired the car. These are all that appeared, ones more often than others, but all of the same kind...

A40/11 - Multifunction camera (mono) (MFK):
- C14687 Communication with the central gateway has a malfunction.
N62/2 - Radar sensors control unit (SGR):
- 680100 CAN communication with component 'B29/6 (Left rear bumper radar sensor)' has a malfunction.
- 630100 CAN communication with component 'B29/3 (Right front bumper DISTRONIC (DTR) sensor)' has a malfunction.
- 680800 CAN communication with component 'B29/6 (Left rear bumper radar sensor)' has a malfunction.
- 630800 CAN communication with component 'B29/3 (Right front bumper DISTRONIC (DTR) sensor)' has a malfunction
N30/7 - N30/7 (Electronic Stability Program Premium control unit)(ESP®):
- 620800 The CAN message from control unit 'CGW [ZGW]' is faulty.
A40/3 - COMAND Online (Head unit):
- C146 Communication with the central gateway has a malfunction.
- C168 Communication with the electronic ignition lock has a malfunction.
A1 - Instrument cluster (IC)
- U014787 Communication with the control unit 'Head unit' has a malfunction. The message is missing.

The affectation mostly is that the command system sometimes shuts itself off (so often) and when it works, sometimes its controllable from steering wheel buttons (and music info is shown in the IC display), sometimes not.

What worries me is that something physical is affecting, because many times when the COMMAND is working, i hit a road bump and it shows "Disconnecting" and turns itself off.

Also the icon from, what i think is, the MFK, dissappears from the screen, also stopping recognising road signals and all that i dont care too much about.


No notice about ESP neither radar sensors affectation, at least i havent realised.

Any advice where to start? Maybe i can unplug the COMMAND from the CAN bus... as with the MKF, is the only one thats easily prescindible, isnt it?
As explained on my first message, CAN distributors were replaced, every cable and ground point looking good on both front footrests... not looked behind dash.
Time to remove the command and open it for resoldering?
I also have bought a FrontSAM module from ebay, and i have recoded it with Vediamo, with the variant values from mine. Mostly to learn and play with it on bench, but also as a possible replacement.

jg.abaitua

If we have a look at the CAN diagram that i compiled from all the WIS schematics, all the modules, except MFK were connecting two different CAN buses. Maybe the clue is something related to all systems that work as gateways?


Can Buses Diagram

Maybe i can start uplugging MFK and COMMAND? and see how the rest behave without them?

CaliBenzDriver

Your survey of chassis networking is very comprehensive. This is really helpful to understand active CAN disruptions.

Your list of fault ranks average/normal. These cars are built with marginal faults from factory. Case in point the goofy SGR specifically.

There are multiple conditions compounding to provide the chaos your experiencing. It's "one thing crashing another" and COMAND is on the receiving end.
One of the excellent issue present on every chassis is the swarming of CGW with overhead traffic retransmit. From there a little more aggravation from rear swampy radars is enough to totally saturate CGW.

Here is what I see outstanding:

• ​​​​​​The ESP/CGW fault
• Rear radar modules faulty
• CMD stopped by bumps (HDD?)

I am not going to question your F-SAM programming or satisfactory painted-GND inspection...


> ACTIONS:
Let's unplug the following modules to observe changes:.
1-- MFK near rear view mirror
2-- Rear radars at harness junction
3-- CMD
4-- (ESP is bad but manages brakes)


> CMD investigation...
Opening it will be time consuming but should be rewarding with easy fixes of poor connections.
It has a spinning HDD that's begging for a SSD upgrade with cloning sw.


If all the above does not lead us to satisfaction, you'll need to sanitize the busy CAN-B that CMD sits on and its painted grounding.
When I did that I noticed CMD booting much-much faster upon ignition.

You will have a far better chassis, engine and tranny when marginal modules stop trashing CGW with unnecessary junk traffic.
For now whole "car reboots" does help sanitize chassis temporarily.

jg.abaitua

hahaha, maybe i dont inspected the ground points as thoughtfully as should... but i was just looking for corrosion, rust, etc... removed the bolt, separated the connected O-rings, and turned them so less strain is put on the cables... just that.

So, when you refer to ESP/CGW you refer to the CGW inside ESP module? or the CGW inside FrontSAM? so, the recommendation is? remove and review ESP module? or directly replace it?

Rear radars? also front ones show the same errors, must i suppose all of them fail? what to look with them? Unplug the SRS module to see if it stops flooding?

About the command... cant be a possibility of having a loose pin or cable? but the thing is not constant and the sympthoms are the same with or without bumps.... so dont know where to start, neither...

CaliBenzDriver

CGW Module is built inside the F-SAM enclosure. The ESP makes use of Gateway to interact with other networks.

As far I know F-SAM/CGW Module pair are reliable unless junk traffic upsets them 1st class: ESP, KeylessG, EIS!

SRS also is built to be reliable and stay that way.

High chance your 2x rear blindspot Radars are one of your top troublemakers. Some car with this condition don't even crank!
🤞

S-Prihadi

When you do the unplugging test at the CAN BUS distribution block , can you also verify that the wiring diagram is accurate for the slot number used on the distribution block , for the said modules.
Thank you

I been wondering what if someone at MB inserted the connector to a wrong slot, it will work, but we who will do troubleshooting may end up with a wrong module disconnect ...LOL

S-Prihadi

JG,

One advice.
While Xentry and other aftermarket capable scanners are good, often they do not produce an accurate DTC to the actual cause.
Could be because of their DTC database is limited or other reason.

Early this year I was playing around with power loss scenario of a very important relay at Front SAM, the relay R.
I learnt a lot from the test to what power loss can do in terms of DTC description.
The test is here : https://mbworld.org/forums/e-class-w...276-820-a.html

Communication Loss DTC from actual power loss is not a surprise.
A non-powered module can't communicate. Hence usually Lost-Com is what we get for DTC.
A module with momentary power-loss usually do not log its power-loss event. Its neighbor modules which will report Lost-Com DTC of the knocked-out module.

Example , your N62/2
N62/2 - Radar sensors control unit (SGR):
- 680100 CAN communication with component 'B29/6 (Left rear bumper radar sensor)' has a malfunction.
- 630100 CAN communication with component 'B29/3 (Right front bumper DISTRONIC (DTR) sensor)' has a malfunction.
- 680800 CAN communication with component 'B29/6 (Left rear bumper radar sensor)' has a malfunction.
- 630800 CAN communication with component 'B29/3 (Right front bumper DISTRONIC (DTR) sensor)' has a malfunction

You need to look at its wiring diagram to have a better understanding on how the said DTC can happen.
Rear bumper is the dirtiest bumper from rain and snow condition. It is wet and salty, if your country has winter salt in use on the roads.

The N62/2 module ( wiring diagram attached )
Gets 2 power sources. The module itself gets Fuse 79 from Rear SAM N10/2.
The Sensors get its own Fuse 59, also from Rear SAM using wire splice Z99/1 where then this +12V power wire goes to front and rear bumper.
For each bumper there is another connector X26/38 ( front bumper ) and X172/2 (rear bumper ), both of them, their pin 1 is the +12V from Z99/1.
From X26/38 connector Pin 1, this +12V power wire is then spliced again as Z36/27 for front bumper, for the 2 sensors.
From X172/2 connector Pin 1, this +12V power wire is then spliced again as Z36/35 for rear bumper, for the 2 sensors.

Both Z36/27 for front bumper and Z36/35 for rear bumper splices are outside the car, at the bumper itself. These two will have higher failure/corrosion rate than any interior splices of N62/2 module.
All these sensors get their negative power from a ground stud, but via splice too, Z36/26 splice for front bumper to W2 ground stud and
Z36/36 splice for rear bumper to either W7/8 ( sedan ) or W7/1 ( wagon ) ground stud, depending on your car a sedan or wagon.
Both Z36/26 and Z36/36 splices are also outside the car, at the bumper itself. Again, these two ground connection will have higher failure/corrosion rate like its +12V cousins splices.

Of course there is a possibility corrosion or liquid induced mild short circuit at the connector itself of the sensor , the 5 pins connector or
at the PCB board soldering itself, inside the sensor assy.

What I am saying is , Lost-Com like this, is very unlikely a CAN BUS issue.
If module N62/2 CAN BUS E or H or both has bad contact, it will be the 62/2 declared as not available or some sort of DTC ( by other modules ) for N62/2 itself and not its 4 sensors.
If short circuit of CAN BUS at N62/2, the shorted CAN BUS will take down all of E CAN and/or H CAN network.

As for :
N30/7 - N30/7 (Electronic Stability Program Premium control unit)(ESP®):
- 620800 The CAN message from control unit 'CGW [ZGW]' is faulty.
Message being faulty does not mean Lost-Com. It could be incomplete data/message from N62/2 via N93 Central Gateway inside Front SAM N10/1.


Power and its ground source to a module is a must inspect first for Lost-Com which does not take down entire network.

You need to start counting the total numbers of module on your car when all are good and running.
Xentry does not give numbers of total modules during a full scan. Autel does.
So when a module go offline, you will know fast from reduction of total numbers of modules and not by lots of DTC arising from the module being out of the network.

Have fun troubleshooting.....

jg.abaitua

Thank you for your comments, i already found thats not right when i replaced the distribution blocks. Mine were not connected like WIS schematics said they should... Maybe in the life of the car, someone fiddled with them? never know...

I also have been reading your posts (CaliBenzDriver and S-Prihadi) about N93 and N10/1 coexistence and search for fuse to reset them by powering off... also about CAN E2 (in my car CAN G as its a 2011)... etc, very interesting.
Will go deeper into the w212 bible when i have time.

OK, regarding my issue. Yesterday i managed to have a bit of time to work on the car.

First i disconnected the rear radars from the harness connector X172/2 in the right side of the trunk, and took a drive. IC instantly complained about it not being available. But during the drive the MFK icon in the dash, still dissapeared, same with Comand not responding to IC.

Then i disconnected MFK (from the connector on itself). Same, IC complained about its two functions not being available. Took a drive. No noticeable change in behavior.

In between of every movement i run the xentry test, to get the errors, clear and run again, so i can deeper review changes later.

Then i removed the Comand module just to find something unexpected;


At first i was a bit shocked because searching on the internet with that reference, didnt showed any results. Then following the connections found that it was bridging the CAN B cables that went to the Comand, that has some meaning...

Then a bit more looking showed that some of the cables that go to this little bugger, were damaged (mainly its gnd):



At first i removed the whole Comand, and took a drive. Then reconnected Comand without the can hijacker. It worked flawlessly, and since there i have not managed to see it Disconnecting nor powering off itself. Video In Motion, stopped working... obviously, or not, will go into this later.

Again took several drives, and in the middle i reconnected the MFK. Which also hasent losed its connection again. Happy MFK icon on dash since then, and also showing music information on the dash (and being manageable from steering wheel buttons) everytime.

Run out of time to do some test later with/without rear radars, but seemed that this will still show same errors. I will during the weekend.

Also still have to review all the Xentry DTCs i exported, but cant wait to share this with you.

Now the strange part, as it always has to be one.
When i bought the car (in 2019), Video In Motion was not working, i remember myself reviewing the forums in search of how to enable it, fiddling with Vediamo, an all that stuff. Then something i did, made it work, cant remember what, because i never wrote down anything and my memory is garbage... but i was absolutely sure that it didnt worked before, then it did. I'll also search my files to try to find what i did, or how to make it work again, but without the CAN Hijack...

CaliBenzDriver

this is great progress, thanks to Master Surya for researching the necessary WIS docs.

You found out a 3rd party mystery box was causing your top issues with COMAND.


The hard part when dealing with so much at once is to focus not to be overwhelmed. Unplugging connectors definitely gets positive results.

S-Prihadi

JG,
Awesome findings on the illegal module .....
Those kind of modules tapped the CAN B usually, it wants reverse gear information for rear view camera and whatever other information it needs.

In fact Auxillary headlight High Beam command sniffer, also tap into CAN B, like this brand : https://www.canm8.com/can-bus-interf...-highbeam.html
I have something like CANM8 for my AUX LED BAR but much more advance sniffer, no need to puncture CAN B wires, it sniffs from OBD2 port and is a pure listener only.
I have this one : https://mbworld.org/forums/e-class-w...a-can-bus.html

I am computer/IT dummy,take note of that.
So I asked a lot of questions to XBB designer himself because XBB dongle is to be connected OBD2 port and I have Banks Gauge Data Monster also using the OBD2 port.
We can't put 2 OBD2 based Gauges parallel, one will crash. I tried already, one with bluetooth dongle from OBDLink model XL and one is the hardwired Banks Gauge. So I was worried.

XBB is a pure listener and not a talker.
OBD2 based gauge is a talker, it will request data to engine computer, so it has to "talk-request".
We can't have 2 talkers on the same OBD2 port, that is the basic explanation by the XBB designer...which I can understand

So I guess modules like Dynavin when and if it does a wrong request or at the wrong time, or whatever, can then create fault to other MB modules.
I do not see Dynavin website offering W212 E-Class products anymore. https://dynavinnorthamerica.com/coll...-mercedes-benz

One thing I am curious on such "foreign" module in our car, will it allow car to sleep properly, as in K2 relay af F32 Prefuse box powered down like it should to prevent battery drain aka be in a DEEP SLEEP STATE ?

My own wiring for the XBB relay unit which is blue tooth based, is after K2 relay, so car will go to deep sleep.

jg.abaitua

Just found what i originally did for getting Video In Motion running:
https://*******.com/Thread-DvDinMoti...cker-NTG-4-5-7


What proves my memory serves me well... but, what happened when removing the CAN hijack that was not working before me doing this procedure, and its undone when removed it?

I'll try to do it again...

jg.abaitua

That thread on the XBB is very interesting, will keep it safe for later proper reading!

Without having done any proper testing, my car has never (in this four years) drained batteries when parked, or at least i havent noticed, as i use to use the car a lot, so its uncommon for it to be parked for more than 2 days without moving.

I'll also try to dig more about that Dynavin module, but havent been able to find anything on the internet about it.

Thank you!!

S-Prihadi

Here is what XBB owner/engineer replied to my questions :

His answer in blue, black is my question. You are into IT, so you will understand better than me.

******


I know a very tiny bit about CAN BUS, now the questions :

01. Can the XBB dongle be programmed in silent mode ? (the TSharkRex user manual said it can be ).
With my limited knowledge on the CAN-BUS of my car and I am totally NOT into programming , nevertheless I know that the OBD2 port on my car if I connect it to
2 devices which perform a data request, either one or both devices will hang/error. In fact Banks Gauge have warned the same.

Yes the XBB Dongle can be programmed in silent mode, most of the Mercedes recipes that we have is in silent mode due to the fact that the vehicle is sending out
cyclic CAN messages without we need to ask the vehicle for data.

The UDS standard for CAN communication states that the CAN gateway should be able to handle up to 8 requests simultaneously to different control units,
- but it depends on the manufacturer how much of the UDS/ISO-TP standard they have implemented in their system.

If the Bank system ask a different control unit than the XBB Dongle it should not be any problem, and even if they are asking the same control unit but different DID numbers it should also work,
it depends on how "smart" the Bank system is and how it reads and wait for the CAN data it asked for.

===============

2AA. One sub-question, is your relay having resistor or diode to absorb the coil de-energize voltage spike ?

2BB. Since I intend to use manual switch to power up your XBB Dongle, do you need to program it to ignore Ignition command ?

2CC. How fast is you device booting up when +12V power available ?


2AA - the hardware is protected for load dump and voltage spikes on all connections, the outputs can withstand an inductive load switch-off energy dissipation of 0.3 J (junction temperature of 150C, 12V and 20A of load).
The ESD, inductive and over-voltage is protected with diodes built in the high side switch. please see specific datasheet for the Infineon BTS 6143D highside switch we are using.

2BB - XBB Dongle will start up directly and start talking/sniffing the CAN bus, all signals that is recognize will be displayed in the App and can be used to activate an output on the XBB PowerUnit,
the SYSTEM_ACTIVE signal will turn off the CAN 2 minutes after the ignition signal is off, but only on recipes where we actively asking for data over UDS,
in your case with the W212 recipes it will not be using the iginition signal, your vehicle will stop sending CAN data when you turn it off (or it takes a few minutes after ignition is turned off).

2CC - The boot-up is instant, but bluetooth bonding/pairing will take a few seconds to init. the connection and for the output to be turned on/off. approx. 3-5 seconds.



I never did use the XBB dongle in manual power mode using extra switch. I just plug it in all the time along with Banks Gauge.
However, when I do not use my car for more than say 3+ days or longer, I will unplug the OBD2 parallel wire kit which has both the XBB and Banks Gauge to reduce power drain.
OBD2 power is from Rear SAM and it is Circuit 30, so it is always ON, unless we disconnect the battery. Circuit 30g in our W212 meant it is via K2 relay at F32 Prefuse Box and 30g will be cut off
using K2 relay when car is in deep sleep.

jg.abaitua

So that device listens for some message in the can bus, then triggers by bluetooth the custom relay so to power whatever you want. Interesting...

What message are/will you be using to trigger your lights? Finally you managed to get them shipped?

I've been investigating a bit, to find my Dynavin device is a clone of Caraudio-Systems TV-500, which has a bit more information on the internet and a pdf manual available.
I'll detail it here for future reference if it could be of any interest for someone.




The manual shows case by case, as it works for a lot of car brands, how it should be configured. I suppose the speed or whatever can message it blocks, is the same on all cars. Is it?

Just to find mine was configured with the DIP switch 1, at the ON position, while it should be OFF:



Then its not working everytime, you should enable/disable it by holding for three seconds the Phone Hang button.

Full PDF:
https://pdf.ampire.de/caraudiosystem...ng_TF-U500.pdf

Tried it and works as expected, will investigate to find if its throwing noise on the bus as before, but at some first tests, not.
Navigation even works with it active, making me worry a bit on how its behaving...

Next work will be to check the rear radars harness, ground points and joints, etc.

Thanks a lot for helping me with this!
Jaime.

S-Prihadi

I sniffed the headlight High Beam message with success using this : https://www.csselectronics.com/produ...terface-cl2000
But then later I found XBB, so I do not need to make my own unit to trigger my AUX LED BAR.

The sniffing story....https://mbworld.org/forums/e-class-w...-you-need.html
The LED BAR Install : https://mbworld.org/forums/e-class-w...ion-plate.html

More test on the LED BAR, its beam spread height adjustment. I don't like over glaring of lights to other people.
https://mbworld.org/forums/e-class-w...e-no-more.html

Thanks for the video in motion module info.
I once almost wanted to install a bigger screen Android yada yada, but I decided not too . Less wiring intervention to our MB car, the better long term for me.
The car CAN BUS is already complicated as it is..... I don't want foreign hardware when they breakdown as in internal short circuit..... causing damage to my other modules.