Dissection of AEM

Hello all!

As I wrote in earlier post, I had enough of banging head against the wall (or in this case, steering wheel) and after numerous failures regarding controlling the Ardic via CAN bus, I decided to go with the flow and ordered the Accessory Electronic Module (AEM) that simplifies that task quite a bit. All one needs is to connect one of the control pins to ground, after which AEM asks CEM to turn on the heater. In theory, I might be able to emulate the functionality of AEM in this matter, however there's no going around purchasing the AEM anyway, since both the module and CEM need to be programmed at Volvo Service to enable this functionality. Only after they are programmed, I'm (hopefully) able to reverse engineer the AEM messaging and emulate it with my own device, making the AEM useless. Whereas without programming, CEM doesn't understand what AEM is saying, and AEM doesn't know what to say. Sounds like a date between a bimbo and a geek.

It's been few weeks since I ordered the AEM, and all this time it has been lingering somewhere in the limbo of finnish post services. Last time something like that happened was one year ago when I ordered bunch of electronics from DealExtreme. Turns out it had been waiting for me for three weeks at the nearest post office 200m away - nobody just bothered to scan it when it arrived! Anyway, finally today I received the module, and of course, I had to pry it open!

Heater (and other functionalities) are controlled by this multi-pin connector. Pin 1: +12V output. Pin 2: Ground. Pin 3: Parking heater enable signal (connect to ground to enable). 4-pin connector is the AEM connector explained in earlier post: Pin 1 (lower left): +12V input. Pin 2 (upper left): ground. Pin 3: (lower right): CAN high signal, Pin 4 (upper right): CAN low signal.

The main cover can be opened by releasing the clips, so at this stage we can continue the dissection without a fear of voiding the warranty.

Let's see what it has eaten:

The PCB is covered with lacquer resembling substance, presumably to protect it from moisture and corrosion. However this makes some of the IC markings unreadable.

Starting for top left corner:
1st row: left: ?. middle: BTS611L1 (smart two channel high side power switch)
2nd row: TLE 4279 (5V low drop voltage regulator)
3rd row: Left: ? Right: ?
4th row: middle: Infineon TLE 6236G (smart octal low side switch)  Right: ?
5th row: 2 x CD4010BQ (CMOS hex buffer)

I didn't feel like removing the metal shield, since that would quite likely leave marks suspicious enough to void the warranty. I might do that later though after AEM has made itself useless :)

Now, some testing:

As you can see, it consumes around 30mA when idle. Not bad, at least now I have some kind of reference to use what kind of power consumption is acceptable.  

I tried  to communicate with it via manual diagnostic commands as well as VIDA, but it didn't react in any way, nor did it send any CAN frames when powered on. Just for a fun I grounded the Pin 3 to create a parking heater enable signal, but nothing happened, just as expected for a device without any programming.

For a moment I thought it might be damanged (either DOA or broken by my endless curiosity) since it just lied there silently, but then I realized it still might be ACKing all CAN bus messages since SardineCAN was sending CAN frames succesfully. In that case it wouldn't be completely dead and might be just lacking suitable firmware. To test this hypothesis I removed the AEM from the bus and immediately SardineCAN went haywire since now there wasn't any device on the network that acknowledges the messages it sends. My assumption is then that the AEM is delivered as tabula rasa condition and it lacks all the functionality except the most basic CAN protocol stuff, such as ACKing messages on the bus. I suppose it doesn't even know it's CAN address yet. How cute.

Next stop: Volvo Service