CAN message breakdown:
Here's what I have so far...Still working on a dbc file but I know where most of the major info is based on my analysis:


0x64h - ABS Module - Traction control torque intervention requests (best guess).
0x96h - ECM Module - Cruise control speed setpoints
0xC8h - TCM Module - Transmission speed sensors (input/output) torque converter slip.
0xFAh - ABS Module - Vehicle Speed and Rolling Distance Counter
0x12Ch -ECM Module - Engine Pedal and Throttle Positions; Engine RPM
0x1F4h - INST Module - Fuel Level and status of headlight and side markers
0x3E8h - TCM Module - Transmission Gear engaged, Trans Oil Temp
0x44Ch - ECM Module - Engine Coolant Temp, Engine Oil Temp, Fuel Consumed (based on injector duty cycle).
0x4B0h - ABS Module - Individual wheel speeds

 

Just an update. Swapped my spare key and problem has not resurfaced so I'm suspecting the RFID chip in the other key is weak or the exciter ring is starting to go. Still looking at CAN data and setting up a box for voltage data logging, but priority is lower since I've got a new issue with the Jag.... Started to leak a little power steering fluid. I see it down by the rack and I hope it's the hose vs the seals in the rack. How frequent are seal failure on the rack vs hose leaks?

 

I am having a problem identical to your in my 2005 Jaguar XKR and I cannot solve it. Can you help me Nerobergstr.

2005 Jaguar XKR won't crank, AC System Display shows ER, J Gate totally dark. Battery is good. On the dash I get DSC Fault, Low Brake Fluid, Limiter Not Available, Restricted Performance, Gearbox Fault. Codes from OBDII are P069 Fuel Pump "A" Control Circuit High, P1637,P1643,P1000 Bought car in this condition so no history but it was driving fine last month according to Carfax. The car hit a speed bump and bumper detached from the right fender and tore down the cable to the fog light and turn signal but other than that no damage. Data link connector 6 to 14 resistance reading is 60.8 ohms. I have heard of the inertia switch tripping but the 2005 Jaguar XKR doesn't have an inertia switch that I can find in the usual spot. Can anyone help me?

 

Nevermind I found what was causing the problem. The inertia switch had tripped. Go figure why all these gremlins come from a tripped switch that is not even in the can bus.

 

Can you inform us where did you locate the Inertia switch?

 

The inertia switch is not located in the same place as the earlier Jaguar XK8 and XKR models (1997 - 2002) in those years it is inside the driver side fuse box on the left of the dashboard. For models from 2003 to 2006 the inertia switch is behind the trim (kick plate) where the hood release is located. towards the front of the car. You need a mirror to see the red top of the switch.

 

Car has been trouble-free for over a year now, but made an hour round trip to run some errands...ran fine. Parked the car in the garage for an hour and then when I tried to head back out I got the issue again. I quickly grabbed the other set of keys, as I had chalked up the previous failures to a week transponder chip in one of the keys. No luck same issue. I was lucky I was at home because I had my measurement tools. I was able to capture the CAN messages in a faulted state and I found that messages 0x96h, 0x112Ch, 0x44Ch, and 0x7D0h were missing. Based on my previous analysis, I believe these messages all come from the ECM. I think my next step will be to make an indicator that shows when one of these messages is missing. I will also trace back the voltage sources to the ECM and check them during the next fault. It might take awhile, they seem to only happen once per year.

 

Based on the schematics, it seems to indicated that the issue may lie in the EMS control relay circuit. I should be able to verify this by pulling fuse 5 in the Engine Compartment Fuse Block. Working theory is that I should see the same behavior. I think I'll wait until the car is safely in the garage and connected to my CAN tools before I try this
It's also possible the issue is in the Ignition Positive Relay 4 Circuit, but I don't think I would see CAN messages from the transmission in this case. Just out of curiosity, has anyone solved this issue by simply swapping out the EMS control relay?

 

Just pull the relay and disassemble it for inspection.
Burnt contacts can do strange things.

 

I will try pulling out the relay and inspecting. Just pulled the fuse labeled 10 and observed the same behavior regarding loss of CAN from the ECM as well as same error messages on the dash. What was different however was that the car still cranked over (obviously didn't start)....Things are still pointing to the main relay. There are other circuits on there as well that may feed the starter circuit.

 

Pulled out the EMS control relay and it looks clean. With the relay disabled, I observe the loss of ECM CAN data but the starter still cranks. I reinstalled the relay, then pulled fuse #5 from 'ENGINE COMPARTMENT FUSE BOX'. This feeds circuits 49 (starter relay) 50 (ECM wakeup) and 51 (fuel injection relay). With this fuse out the behavior is identical to my fault. Will need to dig deeper to see if a fault upstream of this will also knock out the other controllers. It looks like this fuse is driven from circuit 4 (IGNITION POSITIVE RELAY), which is in turn switched by the key through the inertia switch....Hmmm. Any history of intermittent problems with inertia switches on Jags?

 

Along the same lines, I have been having intermittent (sometimes very intermittent) P1797, U2500 codes (2001 XK8, 4.0). The car goes into reduced performance mode and often stalls, but it does not stall every time. It does appear to be associated with heat. Appears to occur more often with the top down, hot outside, AC off. Thus far I have

1. Repaired the ABS module, resoldering anything that looked sketchy including the usual suspects.
2. Traced, examined and cleaned all of the connectors with CAN bus wires between ABS, TCM, ECM, INST, illumination module, etc.
3. Repaired sketchy solder connections in the J-gate illumination module.
4. Repaired the 'computer fan' in the TCM/ECM box (was not operating).
5. Resoldered several sketchy connections in the instrumentation module.
6. Done the simple resistance analyses of the CAN bus electricals.

Fun times, but it is still occasionally happening. My usual approach to 'fixing' this is to drive in reduced performance mode for about 30 seconds (ignoring all the honking when around Durham even with the emergency flashers on), shift to N, turn the car off and on while the car is rolling. Then, apparently good to go for any further length of time, rarely happens again and I've found this to be much safer than pulling off on to the shoulder, life threatening around here.

So, I can now apparently make it happen by getting the engine hot (driving ~30 minutes) with it over 90F outside, turning off the car for ~15-20 minutes, then driving again. Within 5 minutes, it usually happens.

Since it appears to be solely a CAN problem, I connected a CAN analyzer and captured the reduced performance mode that happened when I was stopped at a light (lucky it happened then since many things become quiescent when the car is stopped).

Based on Nerobergstr's fantastic efforts above, I also find that my 0x7D0h disappears at the time of the fault (As noted above, this must be one of the four transmitter module semaphores, unfortunately, I don't know which one of the modules for sure). The other three (0x7D1h through 0x7D3h) still talk. So, based on the fact that ABS, TCM and ECM are reporting CAN failures, I conservatively assume it may not be INST. A bit of an issue is that there was some indication previously that it might be INST based on the presence of a climate code 14 right after failure which was common a while back. This, however, does not appear to be a current thing after the INST soldering.

I also lost 0x096h, 0x12Ch, 0x44Ch during this time. Again, all ECM, based on the above. And the same as with Nerobergstr. So,

1. Does anyone happen to know if 0x7D0h is the ECM?
2. Out of about 63,000 CAN messages recorded during driving and stopping, about 17,000 failed CRC. Good lord. About a quarter have the lost IDs before the time they were lost. Errors on the other IDs are occasional. Obviously, many of the others are so malformed that IDs are not relevant. Does anyone know what is the typical error rate on these systems?
3. Nerobergstr, if you are still around, did you make further progress on this?
4. Beyond what Nerobergstr says above, anyone have any further insight? I.e. What happens if the ECM turns off or loses power during operation? I am not having starting problems at all. Alternatively, is there an error state that silences the ECM under power?

The fact that everything that appears to come from the ECM is quiet on the bus, but everything else is still talking through the ODBII connector, leads me to believe that, it's probably not an intermittent connection on the bus. Obviously that is tentative based on possible error states in the ECM initiated by intermittent connections or error states initiated by the other modules that turn the ECM IDs off, but that seems like an odd approach to error management. So, seems like the ECM is in an error state or is off.

 

CAN should never have that sort of error rate so you're looking at a serious fault, whether bad connection, bad transceiver or who knows.

Worst case, you ought to be able to figure out the CAN IDs if needs be by watching the messages as you momentarily disconnect various modules. But you can probably figure the IDs just by looking for messages that are OBD II or have been posted on the net.

You could also send your own and figure out what responds. And so on.

 

Agreed, there appears to be something wrong, but unsure what a 'reasonable' rate is here. I would expect near zero in other, instrumentation, contexts. A 20 year old car, however, ...

So, pulling fuses with the car running, I can answer my question 1.

ECM - 0x7D0h - pulling LHD passenger side engine fusebox #10 (turns engine off, but ceased transmitting before car went off while everything else continued). Also by the experience above.
TCM - 0x7D1h - pulling LHD driver side engine fusebox #1
INST - 0x7D2h - pulling LHD driver fascia fusebox #14 does nothing to stop it transmitting, just turns the lights off. Identified by process of elimination.
ABS - 0x7D3h - pulling LHD driver side engine fusebox #4

 

This is very useful info.
I was wondering if you made any progress on DBC file. I am trying to integrate custom component through CAN bus and there is almost no information available on Jag's PIDs.