And the SatNav Diag...


Lukeyson

 

 

Attachments:

IMG_4824_NAVIGATION_WEB.jpg [ 27.88 KiB | Viewed 341 times ]

And here are the diag screens for a single-disc low serries Mono LCD.


Lukeyson

 

 

Attachments:

IMG_4841_ALL_ON.jpg [ 25.04 KiB | Viewed 296 times ]

IMG_4842_EVEN_ON.jpg [ 24.78 KiB | Viewed 291 times ]

IMG_4843_ODD_ON.jpg [ 23.09 KiB | Viewed 340 times ]

IMG_4845_MODE_3.jpg [ 23.84 KiB | Viewed 309 times ]

and the rest...


Luke

 

 

Attachments:

IMG_4846_MODE_2.jpg [ 24.71 KiB | Viewed 295 times ]

IMG_4847_MODE_1.jpg [ 24.75 KiB | Viewed 284 times ]

IMG_4848_ALL_OFF.jpg [ 23.3 KiB | Viewed 321 times ]

any chance you can make a list of programs and hardware you are using to do this stuff?

i have a scantool at work which brings up codes and stuff its a carmen lite, but it wont let me get into this as hardcore as you guys are.

i just want to start playinmg with my ba more

Hi there,

I’m just registered to this Forum and want to thank Luceyson for his great job he has done.
I’m searching the net over weeks for information about Ford canbus.
The only really help I found to night was this information from Lukeyson. I read all these 22 Pages.
To my self,
I just started to show what I can do.
My car: Ford Focus CC 2007 (Coupe Cabriole, Germany)
Scan tool: ELM327 1.3 USB

Problem:
Using the remote Key at the standard Focus you can close/open all windows, at front side and at rear side. The Focus CC does close/open only the frond side windows.
(While smoking I always open a rear window and always forget to close it. So I often have to enter the car again, put in the ignition key just to close the window.)
(The rear side windows are power driven as well, when opening/closing the roof they wend up and down including stops at some position in between)
(Funny, when the roof is closed and I hold the close button all windows including rear side close up. But this works only with ignition Key on position.)

I ask my Ford Deale about this and he mentioned Ford doesn’t allow that to change.

But there are Modules on the Market (250 - 300 Euro) just to plug in at the CAN bus and I may define everything I want to do about Roof and windows.
http://www.wit-usa.com/sms/db/smarttop/ ... 1.0/en.php

So I’m trying to find out witch commands are to be send to close the windows.
To open/close the roof by remote key could be a nice extension.

I have few CAN bus Modules (Dietz) witch I can reprogram for my use.

But I’m just at the beginning.
I use the CAN bus from the CD-changer even it has power while the car is off.
And after a while without any action the bus wends to sleep mode.
So when pushing a remote key button the bus wake up and send commands to close/open the doors and windows.

I made some scans but I’m unsure how to interpret,

As I could see
ATsh 1
ATcf xy0 (y means 100, 110, 120, . . . 7E0, 7F0)
(100, 300, 600, 700 deliver no data al all)
ATcm F00
ATma

There are changes at the data stream at
210 40 xx… (I have to look close)
220
227 A0 01 03 00 00 00 00 00 A0 counts up or down while window moves
230 …

237 5E 01 03 00 00 00 00 00 5E counts up or down while window moves
260 …
265 E0 10 00 when door changed on or of (I have to check again)


500 … something is going on I have to check

i.e. from sleep the bus starts with:

501 01 01 00
501 01 01 00
511 11 01 FF
550 50 01 00
504 04 01 00
505 05 01 00
503 03 01 00
210 40 10
265 00 10 00
50C 0C 01 00
275 A0 00 FF
433 00 01 76 01 00 B0 00 00
4DA 02
225 08 68 00 00 03
227 01 00 02 00 00 00 00 00
235 00 6B
237 01 01 03 00 00 00 00 00
245 00
255 10
501 03 02 00
227 01 01 03 00 00 00 00 00
245 10
265 00 10 00
50F 0F 01 00
. . .
4F2 00 28 17 53
285 00 20 99
4D7 12 02 00
230 0F 80 00 00 00 00 00 00
2D5 01 01 FF FF 01 E8 48
2D6 00 00 00 00 00 00 00
2D7 00 00 00 00 00 00
2D8 00 00 00
2D9 00 00 00 00 00 00 00 00
210 40 10
2DA 00 00 00 00 00
265 E0 10 00
2DB FF FF 00 00 00 00 00 00
275 20 00 FF
4D0 41 00 00 00
433 00 01 76 01 00 A0 00 00
225 04 28 00 00 00
227 01 01 03 00 00 00 00 00
235 00 28
237 01 01 03 00 00 00 00 00
245 10
255 10
295 00 00 FF FF F1 03 FF 00
501 03 02 00
4D9 01 70 1F 1A
265 E0 10 00
. . .
230 0F 80 00 00 00 00 00 00
550 01 12 00
210 40 10
265 00 10 00
275 40 00 FF
433 00 01 76 01 00 A0 00 00
265 00 10 00
225 04 28 00 00 00
227 01 01 03 00 00 00 00 00
245 10
295 00 00 FF FF F1 03 FF 00
285 00 20 99
501 03 12 FF
235 00 28
237 01 01 03 00 00 00 00 00
230 0F 80 00 00 00 00 00 00
255 10
210 40 10
265 00 10 00
275 60 00 FF
433 00 01 76 01 00 A0 00 00
4DA 02
265 00 10 00
225 04 28 00 00 00
227 01 01 03 00 00 00 00 00
245 10
503 04 32 FF

In total 4551 lines.
After 503 04 32 FF the bus is at sleep.

Don’t worry all about that.
What I ask for is maybe a little help/ hints (from Lukeyson) how to interpret this.
What is a request, what an answer, is there something well known in between?

What happens with this thread? Its end of June now and the last entry are from April?

And for my knowledge, what is/means Police Mode?

Thank you for any answer.

Regards a_colonia

They look like broadcast messages to me. There's no query/response in that list, just a constant stream of messages being broadcast from modules on the CAN bus. Other modules listen to those messages and chose to do things with them - such as displaying road-speed on the instrument cluster by listening to the messages in broadcasts from the Powertrain control module.

I don't know if there's some master document in Ford that lists what each broadcast message should do, or what format the message should be in. I have seen broadcasts messages only from our Australian BA/BF Falcons and mapped out quite a lot of that stuff. I have seen messages from a later FG model Falcon as well, and while most of those messages are close, some identical, others are just marginally different.

So what am I getting to here?

Well it seems to me that the broadcast messages (some manfacturers or scantool discussions refer to it as 'down the road' messaging) may not only be unique to each manufacturer, but will be unique between different models of the same manufacturer, and different between different years or even specification of the same model.

I've not yet come across documents that list broadcast messages. The BA/BF workshop manual discusses the messages on the CAN bus and what is contained in them, but it doesn't list what the CAN header is or the format of the data. Some items within the FG manual are a little more descriptive and reveal broadcast message headers on occasion, but not the format.

Reverse engineering has been our only method in this instannce I'm afraid.


Luke

I just took a look at the website link you provided - http://www.wit-usa.com/sms/db/smarttop/ ... 1.0/en.php

Looks kinda neat. But it's hard to tell what it's actually doing. I can see that it inserts itself with a T-Loom into the roof controller. But it's' not clear if that means it is intercepting CANBus messages from the bus and sending custom messages to the roof controller, or if it is generating more than that - say elelctrical signals to trigger the box.

Given what you say about the BEM/BCM control messages on the CAN bus though, and the 'diagnostic transparent' mode that it has available for when you drop the car into a dealer service centre, I'm thinking there's a good chance it's doing everything on CAN (including being programming by the indicator stalk - cheeky!)

I'd imagine you could do a lot of that with an ELM (well, it would prorbably take 2 x ELM boxes actually) and the appropriate software, yes. The trick will be to (a) have your own T-Piece loom made up, and given the proprietary nature of meny vehicle connectors that may be hard, and (b) You'd have to have an ELM that went fast enough for you to generate the messages with the appropriate timing - the gap between messages is sometimes critical. Doing an atdp will show what speed your ELM has connected to the CAN bus at. The serial/USB side of the ELM would need to be going at least as fast as that as well.



Lukeyson

I have been looking at the architecture of the FG data networks lately too.

Wow, what a difference compared to the previous vehicles.

The BA/BF/SX/SY digital networks consisted of a High Speed CAN bus connecting all CAN devices, and an ISO9141 bus connecting all ISO devices. 2 networks in total.

In the FG there are 5 Networks now!

(1) Public HS-CAN bus connecting all major CAN modules. RCM (restraints) and PAM (Park sensors)are now both CAN, as they were ISO9141 before. The Bosch 8.0 Module (needed for DSC) was already all CAN (The Bosch 5.3 on the BA was ISO/CAN). This bus is exposed on the standard pins on the OBD2 port.
(2) Private HS-CAN bus - connecting the ABS module and the YAW and Steering Angle Modules. Carries alal the stability control messages. Not exposed at all on the OBD2 port.
(3) MS-CAN bus - for many of the entertainment functions. The Instrument Cluster functions as the gateway between the Public HS-CAN and MS-CAN networks so that some messages can span both networks. MS-CAN is exposed on the OBD2 port, but via non-standard (ie Manufacturer specific allowable in J1962) pins. So to see this traffic using an ELM will require a custom cable be made that swaps the non-standard MS-CAN pins on the OBD2 port to those pins the ELM would traditionally use for CAN.
(4) ISO9141 bus - only used by the ZF tranny now, connected to the same pins on the OBD2 port as before.
(5) LIN - This is a CAN-related bus that can be used for single-wire data-and-power connectivity to cheap-smart-components. Just daisy-chain a single wire to everything on your car, and the digital message on the LIN interface will tell a specific component what to do - turn on headlights, pulse the indicator, move the mirrors, raise/lower the windows, adjust the power seat, unlock the door etc. I reckon a lot of weight can be trimmed out of a car by not having individual wires to every little thing routed back to a centrtal location like a hub-and-spoke starfish. It's great to see LIN creeping into the Falcon, but for now it's only used for the Alarm. I expect lots of things move to LIN in future models.


Lukeyson

I've found a bit of data pertinent to this topic. It is from an FG, so not sure how close it matches to the BA/BF

Msg $3E9 Consists of 8 bytes. Bit Position 0 is from the far left.

Start Bit: 0
#Bits: 4
Function: GearPositionSelected
Park: 0
Reverse: 1
Neutral: 2
Drive: 3
Fourth: 4
Third: 5
Second: 6
Fifth: 7
Intermediate: F

Start Bit: 4
#Bits: 4
Function: GearPositionActual
Neutral: 0
First: 1
Second: 2
Third: 3
Fourth: 4
Fifth: 5
Sixth: 6
Reverse: C
Gear_shift_in_progress: F

Start Bit: 8
#Bits: 8
Function: TransShiftMap
Normal_mode: 0
Sports_mode: 1
Not_used: 2
Hot_mode: 3
Gradient_mode: 4
Traction_map: 5
Manual_mode: 6
Cruisemap: 7

Start Bit: 16
#Bits: 8
Function: TransOilTemperature
Unit: DegC
Offset: -40
Mult: 1

There's a bunch of single-bit values at this point relating to Status and Fault indicators.

Starat Bit: 52
#Bits: 4
Functiopn: GearPositionTarget
Neutral: 0
First: 1
Second: 2
Third: 3
Fourth: 4
Fifth: 5
Sixth: 6
Reverse: C
Invalid: F

Start Bit: 56
#Bits: 8
Function: TorqueConvMult
Unit: Ratio
Offfset: 0
Mult: 0.01

097 and 120 - Desired Torque Trasmission Status
0FC - ABS Config and Shift Map for TCM
12D - Engine Speed and Throttle Position for TCM
44D - Engine Temp and Barometric Pressure for TCM
4C0 - Odo for TCM
650 - Powertrain Configuration for TCM


Lukeyson

Heya Luke,
glad to see you're playing with this now too Been looking forward to your input on this, as it's invaluable to us modders out there.

I'm quite surprised of all the differences - how does the std pin-configurations on the main ICC connectors compare between the 2 models?

good to see some more movement in here. some brilliant info so far

the next thing on my list of things to do is being able to 'push' the ICC buttons via the OBD port as lukeyson has been able to do. after speaking with lukeyson on msn a little he has told me that i need to send a mode 2F command in the format of '2f <pid to change> 07 <data to write>' which isnt doing a great deal for me.
there was also a mention of a mode 10 command to put the ICC into diagnostic mode but i havent been able to find any more info on that.

would be great to get a list of commands used to control the ICC as on the previous page

Thanks

Well, just got my FG Cluster to play with, need to get some plugs and cabling from FTG , then its time to start playing.

Hi, just started playing with an OBDPro scantool and hyperterminal

Thought it would be fun to set the police mode as has been discussed previously but don't seem able to connect to the IC.

Session details below

atz
ELM327 v1.3 compatible
>atdp
AUTO ISO 15765-4 (CAN 11/500)
>0100
41 00 BF 9F B9 10
>ath1
OK
>0100
7E8 06 41 00 BF 9F B9 10
>atsh720
OK
>2103
NO DATA
>atst99
OK
>2103
NO DATA
>atsh7e0
OK
>0100
7E8 06 41 00 BF 9F B9 10
>

Any thoughts?

Cheers

I have read this whole thread and i'm confused as heck...

What scan tool should i get to be able to read and erase faults, and i also would like it to be able to program things like the Cruise control ect....

and be able to interface with those laptop speedo and real time stuff

and make me a tosted sandwich...... and have long legs and ......... no i'll stop my wants now..