I've just located a bunch of PCM Codes for the DSC enabled LPG I6 Falcon in the BFIII/FG range.

It appears that the internal code name for DSC enabled LPG is 'Wombat'.


Luke

wombat = unkillable ???

Ahh. Unkillable. For some reason when I first looked at it I thought you said Unlikeable....


Lukeyson

Im still waiting for some wrecked FG's to turn up so I can start hacking some new stuff

Should be fun.

s it possible to unlock a locked icc stereo, i sold my color screen unit and swapped it for a standard one, i removed and swapped them into the cars, and mine comes up with code, can it be removed with obd tool

car is a ba ute 2004

In theory yes. In practice no. Ford use some sort of security algorithm that works like this:

OBD Tool requests a value in a Mode22 PID from ICC
ICC responds with a value from that PID
OBD Tool sends a custom high-mode message with a multibyte value (the 'unlock' message)

The algorithm that converts the data from the PID into an 'unlock' message is what we don't yet know. Similar to the process used to 'unlock' a PCM for writing a custom tune.

If you have a J2534 tool and a subscription to the FMP software mentioned a few times in this thread, then yes, you can unlock your own ICC. But since the cheapest J2534 that I know of is over $300, it would probably be cheaper for you to go to Ford and get them to do it for $50 or so.

I've been able to do it a few times now with a J2534 tool.


Luke

It would be possible with the right amounts of reverse engineering

Matt

bugga no worries thanks for the help i will go fraud and get them to
unlock it, one ford place told me 110 bucks, thats why i thought i trie this.

thanks

Pity you're not near Newcastle....


Lukeyson

Geez I really should get my new scan tool. Hurry up aussie dollar go back to 98c

Matt

Yeah, those were the days.


Lukeyson

Hey there.

I'm working on developing a custom ICC for my 2006 BF XR8 using some custom built hardware, and will be using the OBD-II connector to receive and display the status of the HVAC controls. While I am at it I thought I would see what else I could intercept through the broadcast messages that may be of interest to display on the screen.

Here's what I've found in the last couple of hours (FYI- This is from a 2006 BF XR8 Auto MCC Prem Sound)

Some nice work, but im in no state to do any reversing as I can barely even type this, will probably read this again when i am actually sober. That might help.

Matt

Yikes. That's awesome. Back on page 20 of this thread I had access to an SY 6 Sp Terry and managed to determine that 3E9 was a ZF message, but didn't have the chance to do any more than that. The ZF has a separate ECU to control the transmissinon, as opposed to the 4A's which are controlled direct from the PCM. I have one car with a 5M and the other with a 4A so long-term analysis of ZF messages are off limits to me. Both cars have Blackoak PCM's as well, so the extra Spanish-Oak broadcasts messages are also a mystery to me.

0C9 seems to be a ZF message as well if you ever have the chance to look into that one.

I suspect that the extra Spaish Oak messages are there so that the ZF can make intelligent shift decisions. The extra PCM messages I don't know anything about are 097, 0FC, 120, 12D, 44D, 4C0, and 650. I've done some analysis on the other PCM stuff - 200, 207, 230, 623, 640, 6F6, 6F8 - and have maybe 1/3 to 1/2 of it worked out. But some stuff will forever be beyond me, like the Smartshield messages in 6F6 and 6F8.


Lukeyson

Datamine was doing some work on a 6A tiptronic shifter, so might have some more info.

The ZF sections on the BF WOrkshop Manual talks about a 3-bit code for the 'Selected' gear and the 'Actual' gear which lines up with your AA and CC.

But the manual specifically says that the Shifter PCB converts this code to a CAN bus message and transmits this information to the TCM via the CAN bus. Now, since I don't see the An lines diverging to the Shifter, I have my doubts on this, but will accept it for now.

So I wonder if 0C9 is the message from the Shifter to the TCM via the CAN bus? I'd expect to see that 'gear selected' (CC) value replicated in there, whereas AA is 'Gear Actual' right?


Lukeyson

Page 303-14-86 of the BF Workshop Manual is the only place so far that I have found what messages get sent from the TCM. They include:

Transmission Fault
Transmission Gear - Selected
Tranmissions Gear - Actual
Transmission Mode
Transmission Temperature

Could the Temp be your DD value?


Lukeyson

Now that you mention temperature...

Yeah, I have some info here that might be useful to you. PM me.

Looking up some other data, PID 1674 is the TCM Transmission fluid temp (Set your header to 7E1 and issue mode 22 query to PID 1674)

The converter for that is nasty. It has an offset of -512, A multiplier of 5 and a divisor of 72. I'm not sure of the order of operation though.

The PCM has a similar PID to measure Engine Oil Temp (EOT). PCM is header 7E0 (default on the ELM), and the EOT is a Mode 22 query to PID 0907. It has the same scaling (-512, x5, /72).

Having said all this, the PID is a double-byte value, whereas the field in that broadcast is only a single byte. But it might be useful to issue queries to the PID and see if it makes any sense temperature wise, then try and play with a similar converter that might make sense for the broadcast.

Keep in mind that there's a chance everything might be sampled and stored in Degrees F and need this nasty conversion for Degrees C.


Lukeyson

Just when I thought there was no more left to learn, I made a new discovery the other day.

In the same way that we know how to toy with the Dials on an ICC using an OBD2 tool (ELM, J2534 etc), I found that there are settings in nearly ALL modules that can be fiddled with the same way.

I already knew some of the BEM stuff - like turning on wipers and the wiper washers etc.

But my recent discovery included settings in the Airbag Module, the ABS Module, the HIM, the Park Aid Module and the ICC.

The ICC was the most interesting of all, because it uncovered a Display Diagnostics mode. The Ford Tech boys probably knew about this all along, but now we know how to trigger it funnally with the ELM style tools. I could also trigger pretty much all of the audio buttons - including the 6 screen presets and the steering-wheel buttons. It was fun ejecting CD's, changing the volume and powering the thing off and on all from by lab pc. But then small things usually do amuse me.... I have only tried this on a DZ High Series ICC, I've yet to see what's available in the Low Series MCC units.

The Display Diagnostics has a few modes - All White, All Black, Coloured Bars, Test Pattern and Navigation Diag. I'll load up pics of each.


Lukeyson

Attachments:

IMG_4820_WHITE_WEB.jpg [ 18.47 KiB | Viewed 6 times ]

IMG_4821_BLACK_WEB.jpg [ 21.63 KiB | Viewed 3 times ]

IMG_4822_COLOUR_BAR_WEB.jpg [ 23.03 KiB | Viewed 3 times ]

IMG_4823_TEST_PATTERN_WEB.jpg [ 39.77 KiB | Viewed 3 times ]