diff --git a/firmware/controllers/sensors/impl/AemXSeriesLambda.cpp b/firmware/controllers/sensors/impl/AemXSeriesLambda.cpp
index 49d154e295..929be7a794 100644
--- a/firmware/controllers/sensors/impl/AemXSeriesLambda.cpp
+++ b/firmware/controllers/sensors/impl/AemXSeriesLambda.cpp
@@ -9,6 +9,8 @@ static constexpr uint32_t rusefi_base = WB_DATA_BASE_ADDR;
 
 // "silent" of wboFaultCodeList
 #define HACK_SILENT_VALUE 1
+// todo: suggest values 1 and 2 into the official WB source fault enum?
+#define HACK_CRANKING_VALUE 2
 
 AemXSeriesWideband::AemXSeriesWideband(uint8_t sensorIndex, SensorType type)
 	: CanSensorBase(
@@ -40,6 +42,15 @@ bool AemXSeriesWideband::acceptFrame(const CANRxFrame& frame) const {
 		id == rusefiBaseId + 1;
 }
 
+void AemXSeriesWideband::refreshState() {
+	if (!engine->engineState.heaterControlEnabled) {
+		faultCode = HACK_CRANKING_VALUE;
+	} else if ((faultCode == static_cast<uint8_t>(wbo::Fault::None)) && (get() == UnexpectedCode::Timeout)) {
+		// fall to timeout from no error state only
+		faultCode = HACK_SILENT_VALUE;
+	}
+}
+
 void AemXSeriesWideband::decodeFrame(const CANRxFrame& frame, efitick_t nowNt) {
 	uint32_t id = CAN_ID(frame);
 
@@ -115,13 +126,11 @@ void AemXSeriesWideband::decodeRusefiDiag(const CANRxFrame& frame) {
 	// no conversion, just ohms
 	esr = data->Esr;
 
-// todo: suggest values 1 and 2 into the official WB source fault enum?
-#define HACK_CRANKING_VALUE 2
-
     if (!engine->engineState.heaterControlEnabled) {
         faultCode = HACK_CRANKING_VALUE;
         return;
     }
+
 	faultCode = static_cast<uint8_t>(data->Status);
 
 	if (data->Status != wbo::Fault::None) {
diff --git a/firmware/controllers/sensors/impl/AemXSeriesLambda.h b/firmware/controllers/sensors/impl/AemXSeriesLambda.h
index a08bfab0de..0ae974f0cd 100644
--- a/firmware/controllers/sensors/impl/AemXSeriesLambda.h
+++ b/firmware/controllers/sensors/impl/AemXSeriesLambda.h
@@ -10,6 +10,8 @@ public:
 
 	bool acceptFrame(const CANRxFrame& frame) const override;
 
+	void refreshState(void);
+
 protected:
 	// Dispatches to one of the three decoders below
 	void decodeFrame(const CANRxFrame& frame, efitick_t nowNt) override;
diff --git a/firmware/init/sensor/init_lambda.cpp b/firmware/init/sensor/init_lambda.cpp
index d14712e98a..03e9d68a97 100644
--- a/firmware/init/sensor/init_lambda.cpp
+++ b/firmware/init/sensor/init_lambda.cpp
@@ -37,8 +37,12 @@ template <>
 const wideband_state_s* getLiveData(size_t idx) {
 #if EFI_CAN_SUPPORT
 	switch (idx) {
-		case 0: return &aem1;
-		case 1: return &aem2;
+		case 0:
+			aem1.refreshState();
+			return &aem1;
+		case 1:
+			aem2.refreshState();
+			return &aem2;
 	}
 #endif