From way back, new discovery:



Update:

C-336 is a junction point for hooking in the Steering Angle Sensor to the CAN bus.

CANH and CANL from the IC, ICC, DLC and SAS all feed into this plug. All the CANH pins are ties together, and all the CANL pins are tied together. In the MCC->ACC thread I thought this was on the Fuse Box (as the fuse box has C-332 to C-335). But it's not.

So C-336 is there because of Dynamic Stability Control.

Interesting, the BF Fairlane Loom I have doesn't have this - so I must have the loom for non DSC Fairlanes. How could that be? I thought they all would have DSC?


Lukeyson

OK, so now I'm at a new stump.

The workshop manual lists all the DTC's from ALL of the modules. However, since the J1979 spec is from the EPA, it looks like only the DTC's from the PCM can be extracted in a standard way using a cheap Scantool with standard software.

If I direct my query to any other module, then none of the J1979 queries work.

So I have an airbag light, and it is registering a DTC somewhere. I know which DTC's I'm looking for, I know the address of the Module responsible for the DTC, so I can issue a directed query to that module. I know it's there because I get a deny response - rather than a 'no-data' if I get the module address wrong. But I can't issue a standard query to read that DTC. If it were the PCM I'd be OK.

So my only thought is that there must be a mode 22 PID somewhere that reports back the DTC's, just like in the PCM, where all the J1979 Mode 01 PIDS are replicated in Mode 22.

Man, I have so much more to learn.


Lukeyson

Baby steps. Some assistance from a friend and some review of other work has me part of the way to an answer.

The J1979 Mode03 PID queries are mirrored in Mode 22. All modules can be quieried for DTC's using:

XXX 22 0200

Where XXXX is the Module Address/Header.



Lukeyson

Last edited by Lukeyson on Wed Mar 12, 2008 6:47 am, edited 2 times in total.

Try to decipher the results of a DTC result on the IC, I think I get:


B1499 = Lamp Turn Signal Left Circuit failure

B1503 = Lamp Turn Signal Right Circuit failure

B1201 = Fuel Sender Circuit Failure


So these DTC's were all triggered when I took the IC out of my car and powered it up.

Well, I guess I'll issue a Clear DTC request. Normally in J1979 this is Mode04 request.

I think...


Lukeyson

Last edited by Lukeyson on Wed Mar 12, 2008 6:49 am, edited 1 time in total.

Nope, I was wrong.

Clearing DTC's required a Mode14 message.


Since then I've been doing some reading up on ISO, because this little Instrument Cluster detour took me away from what i was actually trying to find and fix - the DTC being logged from my Restraint Control Module.


Lukeyson

Last edited by Lukeyson on Wed Mar 12, 2008 6:51 am, edited 1 time in total.

I've tried this without success:

Change the ELM to ISo mode

ATSPA3

(An ATDP shows that I have the right protocol selected - ISO9141-2)

Then I refer to some stuff on the Internet and a possible list of ISO module ID's to set my header to:

ATSHe458F1

Where e4 is the first byte and determines the priority and type of message (functional or physical). Basically this is a Physical node to node message with some random priority - quite low i think.

58 is what I think is the Address of the Restraint Module and

F1 is the address of the Diagnostic tool.

Then I tried a few things that normally get a response. If I get a 7F when querying then I know that there IS a module at that address, saying I'm asking the wrong thing. If I get a timeout then there's no module. Easy right?

So I tried a Mode00 request:

00

And a DTC request:

220200

But all resulted in a timeout.

So - so far I've had no luck. But I'll keep trying. Maybe the Module addresses don't conform to the standard in the BA. Or the priority means more than I thought it would. Or I have to do something unusual with the Bus wake-up. I'm not sure yet.

I'd welcome any ideas or experience with ISO on the BA from anyone....


Lukeyson

Last edited by Lukeyson on Mon Sep 17, 2007 3:06 pm, edited 2 times in total.

Hi Guys,

Just wondering if your still playing with the elmscan 327? Just found this thread and found it a good read. Hopefully it will keep going see ya .

Yep.

But I haven't progressed with any ISO work. The weekend removing the Dash to change the wiring harness (for the manual Climate to Dual-Zone Climate Control ICC) has burned me out a bit for a little while. I'm earning back some domestic brownie points at the moment.

I also have a chance of WDS access coming up. I may have some more to tell after that.


Lukeyson

I have a little bit to report.

Had some fun this last weekend, and got to sniff a few things:

(1) Messages to the ABS Module on the ISO Bus. This includes reading and clearing DTCs. However, the ELM327 appears to have an issue with the BA Falcon implementation of ISO, in that I can sniff queries to the ABS module from the scantool, but can't see replies from the ABS Module.

For reference, with the ELM327 set to ISO (ATSP3) I see the following queries for DTC's:

64 28 F3 22 02 00

Check it out! The 'scantool' address was set to F3 and not F1 like we thought it should be! I'll have to check that out.

Now since I didn't see the response, I couldn't see on the ELM how many DTC's I had. I can't remember now if I did have any. I remember the tool then issueing a Mode13 query to list the DTC's but my logs don't show that. I issued a clear DTC and the message was:

44 28 F3 14 73

(2) Messages to the Restraint Control Module.

A list of PIDS used the command:

64 58 F5 22 02 00

WTF? THIS time the scantool was using address F5. And I got a bit of a response with the ELM, but once again it was corrupted. I got everything bar the 'data' that I wanted. So the response looked like this:

74 F5 58 62 02 < DATA ERROR

It shows the priority field has changed, and the send/receive fields swapped. 62 is the response to a mode 22 request. Next would have been the declaration that this is a response to a 0200 PID request, and then we would have seen the data.

I also remember see Mode13 request for PIDS and Mode14 to clear - but my logs don't show this either. (What was I doing?)

(3) Module reprogramminhg.

We reprogrammed the HIM from SZ to DZ operation. We also did a PATS clear to train my keys to a new BEM, and a Parameter Reset to train all the modules to the new key values.

I think the PATS and Parm Reset need much more experimentation, so while i have some data, I'll leave that alone for the moment pending further work.



Fun eh?


Lukeyson

Last edited by Lukeyson on Wed Mar 12, 2008 6:44 am, edited 1 time in total.

Hey Lukey, interesting finds. Am really enjoying reading all this, as much to see what scantool I want to buy along with what I want to play with on the car. Have you had a look at the actual ICC yet - I've read elsewhere that the screen is programmable to tell it what to display (SZ vs DZ info, etc), but unsure how accurate that info was.

After reading what you told me in your MCC to ACC thread yesterday regarding scantools, I happened onto Auto Enginuity's site. I found reference to extended or enhanced OE Coverage Options. They have available a huge range of Ford systems accessible via their tool with actuation commands, etc. Have a look at http://www.autoenginuity.com/Ford-All-Systems-List.html to see what they have listed. Not as cheap an option as what you are using, but maybe more user-friendly for those not comfortable with hyperterm. Let us know what you think. Am also interested to hear how you go with your new Mongoose Scantool.

That auto enginuity package looks pretty good!
Definantly alot easier to use than hyperterm!

Not badly priced either!

Yeah, I was thinking the price was pretty good too. They are even cheaper on eBay but without the optional OEM stuff - for that you will still have to visit the manufacturer. Would really like to hear from someone who may have tried this unit/software...

Hyperterm is too hard?

www.mancans.com.au


Lukeyson

Oh, and one other thing.

When I redid my Dash Harness, the Flashing Airbag Light went away. However, the DTC's were still logged in the module.

There were a whole heap of them that I cleared! I sniffed the whole thing with my ELM - but since I was not getting replies on the ISO bus, all I have captured are the queries sent TO the ARS Module, and none of the data (including the DTC codes) coming FROM the ARS module.

Bugger!


Lukeyson

Yes hyperterm is too geeky for those of us who only have half a propeller on our heads!