WQ Fiesta XR4 Diagnostics/OBD2 Reverse Engineering

[Luke Plaizier]

Hi All

I'm just going down the path of reverse engineering the diagnostics and data buses on the XR4 - which should be mostly applicable to any WP/WQ Fiesta. I did a bunch of work years ago on the BA Falcon so will be doing the same thing. I just wanted some place to store my findings.

The XR4 had 3 diagnostic networks on board - a High Speed CAN (HS-CAN), a Medium Speed CAN (MS-CAN), and an ISO9141 bus (ISO). The HS-CAN and ISO buses are similar to the falcon, but the MS-CAN bus is on non-standard pins on the OBD2 DLC port under the dash - so I am on the hunt for an ELM327 device with the switchable CAN mode that can be used with apps like FORSCAN.

The process will go along the lines of:

(1) Listen to the down-the-road or broadcast messages on each bus and begin to map changes when I do things in the car - press buttons, open doors, flick switches, change gears, push pedals, latch seatbelts etc. of specific interest is the bus messaging that passes info from the Radio screen onto the Instrument Cluster display.

(2) Capture specific commands as issued by the Ford IDS diagnostic tool and map out the mode, PID and offset/scaling of each.

(3) Programmable modes. Such as enabling/disabling the folding mirrors, or even uploading As-Built data to reprogram a GEM to support auto lights, auto wipers and auto climate. I have another thread where I am doing the physical work for that - but while I struggling with collecting the auto-climate parts, it is time I make serious progress on the diagnostic side.


So far I've only started collecting broadcast messages on the HS-CAN bus. The messages I've seen so far are as follows:

080h, Steering Angle Sensor, I only seem to pickup rate of change, which I might be able to use for the EHPAS power steering pump controller I'm working on. Other users have picked up the actual steering angle, but I don't see that yet.

090h, I think this is from the PCM, I can see some RPM data

200h, from PCM, seems to be 2 values - one with throttle position sensor and another with throttle actuator values. There's another message that also contains what might be throttle position data as well but I have failed to document that yet.

201h, from ABS, I think there are a lot of bitwise fields in this providing stats on what module is present and what features are on or failed, plus some messages on torque reduction

230h, from PCM - seems to be the message for auto-transmission data (selected gear, actual gear, gearshift button position). So I get nothing - not even reverse surprisngly, I thought I would at least get that.

360h, I think from GEM, could be restraints - I haven't seen any movement in this no matter what I do.

430h, might be instrument cluster, seems to have a fuel level field, and might have other fields for IC values (brake fluid level, overheat, coolant eytc)

433h, must be the GEM - I have mapped the door open/close status, door lock status and the wiper, washer, intermittent/auto settings

4B0h, from ABS - gives regular data on the wheel speed sensors.

420h, 428h, 620h, 630h - no idea what these do yet. Not even sure what modules they are from. Nothing changes in them no matter what I do.

None of those messages on the HS-CAN bus have anything in them when the radio display changes, so odds on that data is on the MS-CANbus, which I'll try to look into once I have a diagnostic toolthat I can switch to MS-CAN.

At some point when my data and scaling factors are a bit more accurate, I'll post a link to a spreadsheet with more detailed info.


Lukeyson