|
Lukeyson |
|
|||
|
||||
Top | |
Lukeyson |
|
|||
|
And here are the diag screens for a single-disc low serries Mono LCD.
Lukeyson
|
|||
Top | |
Lukeyson |
|
|||
|
||||
Top | |
rushing on acid |
|
||
|
any chance you can make a list of programs and hardware you are using to do this stuff?
i have a scantool at work which brings up codes and stuff its a carmen lite, but it wont let me get into this as hardcore as you guys are. i just want to start playinmg with my ba more |
||
Top | |
a_colonia |
|
||
|
Hi there,
I’m just registered to this Forum and want to thank Luceyson for his great job he has done. I’m searching the net over weeks for information about Ford canbus. The only really help I found to night was this information from Lukeyson. I read all these 22 Pages. To my self, I just started to show what I can do. My car: Ford Focus CC 2007 (Coupe Cabriole, Germany) Scan tool: ELM327 1.3 USB Problem: Using the remote Key at the standard Focus you can close/open all windows, at front side and at rear side. The Focus CC does close/open only the frond side windows. (While smoking I always open a rear window and always forget to close it. So I often have to enter the car again, put in the ignition key just to close the window.) (The rear side windows are power driven as well, when opening/closing the roof they wend up and down including stops at some position in between) (Funny, when the roof is closed and I hold the close button all windows including rear side close up. But this works only with ignition Key on position.) I ask my Ford Deale about this and he mentioned Ford doesn’t allow that to change. But there are Modules on the Market (250 - 300 Euro) just to plug in at the CAN bus and I may define everything I want to do about Roof and windows. http://www.wit-usa.com/sms/db/smarttop/ ... 1.0/en.php So I’m trying to find out witch commands are to be send to close the windows. To open/close the roof by remote key could be a nice extension. I have few CAN bus Modules (Dietz) witch I can reprogram for my use. But I’m just at the beginning. I use the CAN bus from the CD-changer even it has power while the car is off. And after a while without any action the bus wends to sleep mode. So when pushing a remote key button the bus wake up and send commands to close/open the doors and windows. I made some scans but I’m unsure how to interpret, As I could see ATsh 1 ATcf xy0 (y means 100, 110, 120, . . . 7E0, 7F0) (100, 300, 600, 700 deliver no data al all) ATcm F00 ATma There are changes at the data stream at 210 40 xx… (I have to look close) 220 227 A0 01 03 00 00 00 00 00 A0 counts up or down while window moves 230 … 237 5E 01 03 00 00 00 00 00 5E counts up or down while window moves 260 … 265 E0 10 00 when door changed on or of (I have to check again) 500 … something is going on I have to check i.e. from sleep the bus starts with: 501 01 01 00 501 01 01 00 511 11 01 FF 550 50 01 00 504 04 01 00 505 05 01 00 503 03 01 00 210 40 10 265 00 10 00 50C 0C 01 00 275 A0 00 FF 433 00 01 76 01 00 B0 00 00 4DA 02 225 08 68 00 00 03 227 01 00 02 00 00 00 00 00 235 00 6B 237 01 01 03 00 00 00 00 00 245 00 255 10 501 03 02 00 227 01 01 03 00 00 00 00 00 245 10 265 00 10 00 50F 0F 01 00 . . . 4F2 00 28 17 53 285 00 20 99 4D7 12 02 00 230 0F 80 00 00 00 00 00 00 2D5 01 01 FF FF 01 E8 48 2D6 00 00 00 00 00 00 00 2D7 00 00 00 00 00 00 2D8 00 00 00 2D9 00 00 00 00 00 00 00 00 210 40 10 2DA 00 00 00 00 00 265 E0 10 00 2DB FF FF 00 00 00 00 00 00 275 20 00 FF 4D0 41 00 00 00 433 00 01 76 01 00 A0 00 00 225 04 28 00 00 00 227 01 01 03 00 00 00 00 00 235 00 28 237 01 01 03 00 00 00 00 00 245 10 255 10 295 00 00 FF FF F1 03 FF 00 501 03 02 00 4D9 01 70 1F 1A 265 E0 10 00 . . . 230 0F 80 00 00 00 00 00 00 550 01 12 00 210 40 10 265 00 10 00 275 40 00 FF 433 00 01 76 01 00 A0 00 00 265 00 10 00 225 04 28 00 00 00 227 01 01 03 00 00 00 00 00 245 10 295 00 00 FF FF F1 03 FF 00 285 00 20 99 501 03 12 FF 235 00 28 237 01 01 03 00 00 00 00 00 230 0F 80 00 00 00 00 00 00 255 10 210 40 10 265 00 10 00 275 60 00 FF 433 00 01 76 01 00 A0 00 00 4DA 02 265 00 10 00 225 04 28 00 00 00 227 01 01 03 00 00 00 00 00 245 10 503 04 32 FF In total 4551 lines. After 503 04 32 FF the bus is at sleep. Don’t worry all about that. What I ask for is maybe a little help/ hints (from Lukeyson) how to interpret this. What is a request, what an answer, is there something well known in between? What happens with this thread? Its end of June now and the last entry are from April? And for my knowledge, what is/means Police Mode? Thank you for any answer. Regards a_colonia |
||
Top | |
Lukeyson |
|
|||
|
They look like broadcast messages to me. There's no query/response in that list, just a constant stream of messages being broadcast from modules on the CAN bus. Other modules listen to those messages and chose to do things with them - such as displaying road-speed on the instrument cluster by listening to the messages in broadcasts from the Powertrain control module.
I don't know if there's some master document in Ford that lists what each broadcast message should do, or what format the message should be in. I have seen broadcasts messages only from our Australian BA/BF Falcons and mapped out quite a lot of that stuff. I have seen messages from a later FG model Falcon as well, and while most of those messages are close, some identical, others are just marginally different. So what am I getting to here? Well it seems to me that the broadcast messages (some manfacturers or scantool discussions refer to it as 'down the road' messaging) may not only be unique to each manufacturer, but will be unique between different models of the same manufacturer, and different between different years or even specification of the same model. I've not yet come across documents that list broadcast messages. The BA/BF workshop manual discusses the messages on the CAN bus and what is contained in them, but it doesn't list what the CAN header is or the format of the data. Some items within the FG manual are a little more descriptive and reveal broadcast message headers on occasion, but not the format. Reverse engineering has been our only method in this instannce I'm afraid. Luke |
|||
Top | |
Lukeyson |
|
|||
|
I just took a look at the website link you provided - http://www.wit-usa.com/sms/db/smarttop/ ... 1.0/en.php
Looks kinda neat. But it's hard to tell what it's actually doing. I can see that it inserts itself with a T-Loom into the roof controller. But it's' not clear if that means it is intercepting CANBus messages from the bus and sending custom messages to the roof controller, or if it is generating more than that - say elelctrical signals to trigger the box. Given what you say about the BEM/BCM control messages on the CAN bus though, and the 'diagnostic transparent' mode that it has available for when you drop the car into a dealer service centre, I'm thinking there's a good chance it's doing everything on CAN (including being programming by the indicator stalk - cheeky!) I'd imagine you could do a lot of that with an ELM (well, it would prorbably take 2 x ELM boxes actually) and the appropriate software, yes. The trick will be to (a) have your own T-Piece loom made up, and given the proprietary nature of meny vehicle connectors that may be hard, and (b) You'd have to have an ELM that went fast enough for you to generate the messages with the appropriate timing - the gap between messages is sometimes critical. Doing an atdp will show what speed your ELM has connected to the CAN bus at. The serial/USB side of the ELM would need to be going at least as fast as that as well. Lukeyson |
|||
Top | |
Lukeyson |
|
|||
|
I have been looking at the architecture of the FG data networks lately too.
Wow, what a difference compared to the previous vehicles. The BA/BF/SX/SY digital networks consisted of a High Speed CAN bus connecting all CAN devices, and an ISO9141 bus connecting all ISO devices. 2 networks in total. In the FG there are 5 Networks now! (1) Public HS-CAN bus connecting all major CAN modules. RCM (restraints) and PAM (Park sensors)are now both CAN, as they were ISO9141 before. The Bosch 8.0 Module (needed for DSC) was already all CAN (The Bosch 5.3 on the BA was ISO/CAN). This bus is exposed on the standard pins on the OBD2 port. (2) Private HS-CAN bus - connecting the ABS module and the YAW and Steering Angle Modules. Carries alal the stability control messages. Not exposed at all on the OBD2 port. (3) MS-CAN bus - for many of the entertainment functions. The Instrument Cluster functions as the gateway between the Public HS-CAN and MS-CAN networks so that some messages can span both networks. MS-CAN is exposed on the OBD2 port, but via non-standard (ie Manufacturer specific allowable in J1962) pins. So to see this traffic using an ELM will require a custom cable be made that swaps the non-standard MS-CAN pins on the OBD2 port to those pins the ELM would traditionally use for CAN. (4) ISO9141 bus - only used by the ZF tranny now, connected to the same pins on the OBD2 port as before. (5) LIN - This is a CAN-related bus that can be used for single-wire data-and-power connectivity to cheap-smart-components. Just daisy-chain a single wire to everything on your car, and the digital message on the LIN interface will tell a specific component what to do - turn on headlights, pulse the indicator, move the mirrors, raise/lower the windows, adjust the power seat, unlock the door etc. I reckon a lot of weight can be trimmed out of a car by not having individual wires to every little thing routed back to a centrtal location like a hub-and-spoke starfish. It's great to see LIN creeping into the Falcon, but for now it's only used for the Alarm. I expect lots of things move to LIN in future models. Lukeyson |
|||
Top | |
Lukeyson |
|
|||
|
wheee wrote: Hey there. I'm working on developing a custom ICC for my 2006 BF XR8 using some custom built hardware, and will be using the OBD-II connector to receive and display the status of the HVAC controls. While I am at it I thought I would see what else I could intercept through the broadcast messages that may be of interest to display on the screen. Here's what I've found in the last couple of hours (FYI- This is from a 2006 BF XR8 Auto MCC Prem Sound) Code: $3E9 AA BB ?? ?? ?? ?? CC DD [...heaps of stuff deleted - Luke.... ] I'm not sure that this is of any use to anybody- but thought i'd put my 2 cents in. Must give a special thanks to Lukeyson, your posts have saved me considerable work deciphering the HVAC messages. I've found a bit of data pertinent to this topic. It is from an FG, so not sure how close it matches to the BA/BF Msg $3E9 Consists of 8 bytes. Bit Position 0 is from the far left. Start Bit: 0 #Bits: 4 Function: GearPositionSelected Park: 0 Reverse: 1 Neutral: 2 Drive: 3 Fourth: 4 Third: 5 Second: 6 Fifth: 7 Intermediate: F Start Bit: 4 #Bits: 4 Function: GearPositionActual Neutral: 0 First: 1 Second: 2 Third: 3 Fourth: 4 Fifth: 5 Sixth: 6 Reverse: C Gear_shift_in_progress: F Start Bit: 8 #Bits: 8 Function: TransShiftMap Normal_mode: 0 Sports_mode: 1 Not_used: 2 Hot_mode: 3 Gradient_mode: 4 Traction_map: 5 Manual_mode: 6 Cruisemap: 7 Start Bit: 16 #Bits: 8 Function: TransOilTemperature Unit: DegC Offset: -40 Mult: 1 There's a bunch of single-bit values at this point relating to Status and Fault indicators. Starat Bit: 52 #Bits: 4 Functiopn: GearPositionTarget Neutral: 0 First: 1 Second: 2 Third: 3 Fourth: 4 Fifth: 5 Sixth: 6 Reverse: C Invalid: F Start Bit: 56 #Bits: 8 Function: TorqueConvMult Unit: Ratio Offfset: 0 Mult: 0.01 |
|||
Top | |
Lukeyson |
|
|||
|
Lukeyson wrote: Yikes. That's awesome. Back on page 20 of this thread I had access to an SY 6 Sp Terry and managed to determine that 3E9 was a ZF message, but didn't have the chance to do any more than that. The ZF has a separate ECU to control the transmissinon, as opposed to the 4A's which are controlled direct from the PCM. I have one car with a 5M and the other with a 4A so long-term analysis of ZF messages are off limits to me. Both cars have Blackoak PCM's as well, so the extra Spanish-Oak broadcasts messages are also a mystery to me. 0C9 seems to be a ZF message as well if you ever have the chance to look into that one. I suspect that the extra Spaish Oak messages are there so that the ZF can make intelligent shift decisions. The extra PCM messages I don't know anything about are 097, 0FC, 120, 12D, 44D, 4C0, and 650. I've done some analysis on the other PCM stuff - 200, 207, 230, 623, 640, 6F6, 6F8 - and have maybe 1/3 to 1/2 of it worked out. But some stuff will forever be beyond me, like the Smartshield messages in 6F6 and 6F8. Lukeyson 097 and 120 - Desired Torque Trasmission Status 0FC - ABS Config and Shift Map for TCM 12D - Engine Speed and Throttle Position for TCM 44D - Engine Temp and Barometric Pressure for TCM 4C0 - Odo for TCM 650 - Powertrain Configuration for TCM Lukeyson |
|||
Top | |
mrbean |
|
||
|
Heya Luke,
glad to see you're playing with this now too ![]() I'm quite surprised of all the differences - how does the std pin-configurations on the main ICC connectors compare between the 2 models? |
||
Top | |
millers |
|
||
|
good to see some more movement in here. some brilliant info so far
![]() the next thing on my list of things to do is being able to 'push' the ICC buttons via the OBD port as lukeyson has been able to do. after speaking with lukeyson on msn a little he has told me that i need to send a mode 2F command in the format of '2f <pid to change> 07 <data to write>' which isnt doing a great deal for me. there was also a mention of a mode 10 command to put the ICC into diagnostic mode but i havent been able to find any more info on that. would be great to get a list of commands used to control the ICC as on the previous page Thanks |
||
Top | |
aumatt |
|
|||
|
Well, just got my FG Cluster to play with, need to get some plugs and cabling from FTG , then its time to start playing.
_________________ 2004 Harvest Green XR6
|
|||
Top | |
G.Abe |
|
||
|
Hi, just started playing with an OBDPro scantool and hyperterminal
Thought it would be fun to set the police mode as has been discussed previously but don't seem able to connect to the IC. Session details below atz ELM327 v1.3 compatible >atdp AUTO ISO 15765-4 (CAN 11/500) >0100 41 00 BF 9F B9 10 >ath1 OK >0100 7E8 06 41 00 BF 9F B9 10 >atsh720 OK >2103 NO DATA >atst99 OK >2103 NO DATA >atsh7e0 OK >0100 7E8 06 41 00 BF 9F B9 10 > Any thoughts? Cheers |
||
Top | |
sclarke7171 |
|
|||
|
I have read this whole thread and i'm confused as heck...
What scan tool should i get to be able to read and erase faults, and i also would like it to be able to program things like the Cruise control ect.... and be able to interface with those laptop speedo and real time stuff and make me a tosted sandwich...... and have long legs and ......... no i'll stop my wants now.. |
|||
Top | |
Who is online |
---|
Users browsing this forum: No registered users and 23 guests |