And, er, the Tekmate software and manual for that tool in your link seems to be available for download here: http://www.tekmatetools.com/support.html

I guess I'll have to give it a go with my ELM327 tool then eh?

You're a goldmine mate!


Lukeyson

Hmm, Software Link may not work directly. I got to it my going to www.motorcraft, technical resources, non-subscription resources, Diagnostic Tool Support, IDS. In the new popup window I selected 'Download Software', the IDS and then at the bottom of the page is a link to '48(2007.3 DVD)'.

It is about 196MB and either installs online or you can download to a file and install later.

It looks, however, like you'd need an active subscription in order to use it - and a VCM of course!


Lukeyson

Well, like I though, this stuff is not cheap.

A setup with VCM and cables - but no notebook hardware or PDA - sold just recently on eBay for $3705 US. ( http://cgi.ebay.com/ebaymotors/Ford-Rot ... dZViewItem ).

There's a 'VCM' component to the older NGS unit as well - I have no idea if it's compatible. ONe's up for sale on ebay now ( http://cgi.ebay.com/ebaymotors/Rotunda- ... enameZWD2V )


Lukeyson

Would there be any benefit to anybody if I uploaded the Ford IDS Manuals up here? I've got them all now.

And I also found an answer to the VCM NGS question that suprised me:

Converting a VCM from NGS+ to IDS use

(1) The VCM must be reprogrammed by the NGS+ Diagnostic Base Station (DBS) PC to an NGS+ level of 24.3 or higher.
(2) Use a VCM to Laptop Cable to connect the VCM to the IDS laptop


Lukeyson

This is a great table, I just had to share it.

The VCM is an interface module that connects a PC (IDS) or PDA (PDS) to the OBD2 port (They call it a DLC or Data Link Connector).

The VMM is a module that does tests on non-DLC parts of the car and interfaces to an IDS or PDS. The PDS looks very restricted with the VMM though, most VMM tasks require the IDS

Like I said, awesome table.

http://www.motorcraftservice.com/vdirs/ ... _usage.asp

Hi again Luke
Yeah i saw the NGS VCM in my travels - But NGS was the old style tester
I had a post up years ago with pictures of the wds and ngs and pds but we lost it when we lost fm v1!
I need to get another login to fsti!

yeah there is ids online but its expensive
http://cgi.ebay.com/ebaymotors/Ford-IDS ... enameZWD2V

the software couldnt be too hard to geta crack for
Ill download the software and have a look and see if we can crack it

Gee, you got to be careful. I just had a long hard look at the Tekmate after downloading the software. It is elm based, but only ELM322, so it doesn't do CAN! I was about to sprog about how good the software looks but looking at the Manual the last time it was updated was in 2005, so I checked deeper, found the ELM322 reference, and yep, no CAN.


Lukeyson

More discoveries today. I can now see

Avg Speed, Avg L/Hr/100, Run Time, Road Speed, Instrument Cluster 'Night' mode when the headlights are on, Fuel Level (Maybe, not sure yet) Range, Inst L/Hr/100 and Odometer.

On the SX Territory, I also found all the additional buttons on the ICC, and the broacast code for the Steering Position sensor that feeds the Bosch 8 ESP Module. I believe I have also discovered new messages for the Yaw Sensor as well.

Will type this up into the message a few posts back that showed the broadcast values.


Lukeyson

Hey guys, nothing to contribute yet, however am very interested in the work you've already done. Hope I can catch up on your work and be of assistance in the near future.

There's a website that has some 'encoded' files that apparently have the Ford Enhanced PIDS in them, Ford DTC's, and Mode 06 values. Whilst I can see the PID values in Wordpad, it looks like we'd need to do a bit of reverse-engineering to try and decode the mappings to th PID text values listed in the workshop manual.

The website link is here for your reference - http://www.obd-2.com/

I'll talk about Mode06 a bit more soon actually, as I've mapped out the supported Continuous and Non-Continuous tests available on a BA that's listed in Mode 01 PID 01 bytes B, C and D. The BA only supports 4 of the 12 tests.


Lukeyson

Mode 06

So far we've had a brief look at some of the stuff we can get out of the BA Falcon. J1979 was the standard we discussed earlier, and the 'Modes' that expose various bits of data.

Mode01 is a big one, exposing a bunch of standard data. For cars that also support J2190, we could potentially get access to data stored in over 90 standards-based PIDs. As it is, the BA Falcon only supports the J1979 component of Mode 1, so we have only PIDs $00 to $19.

Mode01 PID01 however is a 4-byte record. I'll get Byte1 out of the way first.

Mode 01 PID01 Byte1 is comprised of 8 bits that we call A7 to A0. The left most bit, called the most significant bit, is A7. This bit indiciates whether the 'MIL' light is on, or in our case, the light in the top left of the instrument cluster that indicates a Powertrain error. Bits A6 to A0 are used to indicate how many 'DTCs' have been registered. These are the bits to look at first if there's a problem. From here, you need to issue a mode 02 request to view the freeze frame data of all values when a major DTC was registered, and then use mode 03 to view all of the recorded DTC's out of the PCM. Mode 04 then lets you clear all DTC's and test results and start again. Mode 07 can be used to see if single drive-cycle DTC's have been registered that need 2 or more drive-cycles before the DTC will be converted to a Mode 3 DTC.

But back to Mode 01 PID 01. The remaining 3 bytes - B, C and D - are used as a bitwise flag to show which Mode 06 tests are supported, and which of those tests have 'completed', enabling further data to be retrieved. The Bits in bytes B, C and D are arranged as follows:

Test available Test complete
Misfire B0 B4
Fuel System B1 B5
Components B2 B6
Reserved B3 B7
Catalyst C0 D0
Heated Catalyst C1 D1
Evaporative System C2 D2
Secondary Air System C3 D3
A/C Refrigerant C4 D4
Oxygen Sensor C5 D5
Oxygen Sensor Heater C6 D6
EGR System C7 D7

So a query to Mode 01 PID 01 will return 3 bytes, with each byte consisting of 2 x HEX numbers. A typical response is as follows: 00 06 60 60. FYI, 6 HEX = 0110 in binary. So let's dive in and check the 'bits' that are turned on.

(1) Byte - Bit values
A7A6A5A4A3A2A1A0 B7B6B5B4B3B2B1B0 C7C6C5C4C3C2C1C0 D7D6D5D4D3D2D1D0
(2) Hex Numbers
00 06 60 60
(3) Binary Numbers
0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 1 1 0 0 0 0 0 0 1 1 0 0 0 0 0

So from that, we see that we have only 4 supported tests, of which 2 have completed:

Supported Tests = B2, B1, C6 and C5
Completed Tests = D6 and D5

The tests, listed out, are

Fuel System (Incomplete)
Components (Incomplete)
Oxygen Sensor (Completed)
Oxygen Sensor Heater (Completed)

So how do the tests get run?

Most OBD II ("On-Board Diagnostics II") diagnostic monitors will run at some time during normal operation of the vehicle. However, to satisy all of the different Trip enable criteria and run all of the OBD II diagnostic monitors, the vehicle must be driven under a variety of conditions. The following 'generic' drive cycle will (theoretically) allow all monitors to run on a vehicle. (Note: Drive cycle specifics vary by vehicle!). You can tell I've plucked this off the net !

1. Ensure that the fuel tank is between 1/4 and 3/4 full.
2. Start cold (below 86°F /30°C) and warm up until engine coolant temperature is at least 160° F (typically requires at least one minute; up to 3 minutes).
3. Accelerate to 40-55 MPH at 25% throttle and maintain speed for five minutes.
4. Decelerate without using the brake (coast down) to 20 MPH or less, then stop the vehicle. Allow the engine to idle for 10 seconds, turn the key off, and wait one minute.
5. Restart and accelerate to 40-55 MPH at 25% throttle and maintain speed for two minutes.
6. Decelerate with using the brake [or the clutch!] by coasting down to 20 MPH or less, then stop the vehicle. Allow the engine to idle for 10 seconds, turn the key off, and wait one minute.

The Ford Specific drive cycle can be found here - but requires in this description that you have access to an OEM scantool: http://www.obdii.com/drivecycleford.html

The data generated by the Drive Cycle tests can be extracted using a scantool. And luckily for us, the PIDs for those tests are in the public domain.

You can find a PDF for various 'Ford Global' continuous and non-continuous tests from the Motorcraft Website: http://www.motorcraftservice.com/vdirs/ ... uIndex1=17

Motorcraft plays an important part in the diagnostics area in the Ford world. You'll find that most service centres around Australia use either the older WDS (Worldwide Diagnostic System) tool - of which support finished up in 2006 - the NGS+ tool or the newer IDS system - which you may have seen us discussing in this thread - specifically the VCM component, which is effectively the 'REAL' OBDII scantool that you'd need in order to run any of the Ford diagnostic software, whether it be on a PC (IDS) or on a PDA (PDS).

In lieu of having $3000US, however, much of what we'll discuss from here on in will be using a generic ELM327 based scantool.

As a footnote, the BA Falcon also runs a number of 'proprietary' continuous tests. These tests set DTC's if they fail. Some tests registers DTC's after 1 drive cycle, and others may take 2 or more drive cycles to show. The tests are:

* Analogue/Digital Limit Check
* Air Conditioning System Tests
* CMP Test
* EDIS Test
* VSS Test
* Auto Transmission Test
* Traction Control Test
* Output Circuit Check
* Setting Of Failure Mode (FMEM) flags
* Servicing Warm-up Counters
* Fault Filter Calibration

It's worth noting that the BA Falcon has not yet moved many of these tests into the standards-based mode06 access - such as the Aircon tests, and the EGR (EVAP) tests.

Lukeyson

!!! CALLING ALL MOTIVATED REVERSE ENGINEERS !!!

I need help deciphering this file. It contains what looks to be the Ford Enhanced PIDS in a coded format - but it is repetitive, so it looks to be reversible somehow.

I shall attach the raw file to this post.

I am working on a 'massaged' version that splits that file into the components that I can see - the mode (choice of mode 01, 22, 23 and AE), the PID (a 2 x byte PID for all) and a 121 byte (242 hex character) string.

 

 

Attachments:

File comment: Crack this file and you'll be my best mate forever. How much it relates to the BA Falcon, then, is another question, but a question we can then try to answer if we can figure out the text. You'll need a HEX editor to see the true detail. Encoded Ford Enhanced PIDS.txt [128.04 KiB] Downloaded 1361 times

My work on that list of PIDS in the encoded file hasn't gone very far. I've done bitwise rotations, character statistic analysis - a whole bunch of stuff. But the information is not going to come out easy.

I've done a little bit more work on analysing what data I can see from the broadcast messages by sitting in the territory for a while, and comparing warm-idle with cold-off values. Nothing seriously new to report, although the differences between Manual and Auto Climate control are interesting. But aside from all of this, I've been provided with another lead that is promising. If that turns into something that I'm allowed to let you know about, then I shall.

I think it's about time I got me a better cable and some data while the car is on the move.

In all of this I haven't been able to see any CAN messages regarding lights, hazards, driving lights, cornering lights, indicators or anything, and last night worked out why. All of the lights and the multifunction switch are connected directly to the Instrument Cluster. And it's the Instrument Cluster that turns on or flashes the lights. Now it's starting to make sense.

The only message between the BEM and IC that relates to the lights is the sunload sensor, which provides data for auto lights-on or lights-off. As I was doing work in the shed yesterday on a rainy day, I couldn't generate enough light or heat to affect the sunload sensor (even with a 500W spotlight) - so the next sunny day I get I'll try to find that message.

The Territory has the Low Washer Sender - so I know to look for it but will need to remove the LHF splash guard and physically disconnect the wire to observe and change. Either that, or run the thing dry....

And I've only just realised that the Restraint Module sends messages to the IC to indicate seatbelt status, so that too will be my next target.

And finally, the Parking Aid Module is on one of the buses, and the only reason i can see for why this might be is that the ICC can be used to control the volume of the reverse alert. As this is on the ISO bus, and not on the CAN bus, I haven't even started to look. But why this is of interest to me is that the ICC is not even ON the ISO bus - so how do messages get through? I can see that the ABS/TCM/DSC Module is connected to both buses. Could this be functioning as some sort of bridge between the two bueses? Someone warned me about this possibility before, and only now am I coming to understand why.



Lukeyson

And we march ever onwards.


I've found a value that changes when the sunload changes (ie Warm sunny day and intriduce a shield book). I've also found the messages from the PCM to the IC to show that the Cruise is 'On' and that it's been 'Set'. Those are the only two cruise messages I can see on the IC anyway.

Did a scan while moving, and my throttle position, rpm and speedo discovered values look right. I was also watching as the inst consumption values changed, and was able finally to find the bit that determines whether we're in L/100 or L/HR.

I looked at the Park Aid module wiring and was saddened to see that there is a separate line from the ICC to the PAM itself - which will no doubt be the volume control. Disappointing. I also believe the that Restraint Control Module is wired direct to the IC - but will confirm that.



Lukeyson

Last edited by Lukeyson on Wed Mar 12, 2008 7:30 pm, edited 1 time in total.