Welcome to the Australian Ford Forums forum.

You are currently viewing our boards as a guest which gives you limited access to view most discussions and inserts advertising. By joining our free community you will have access to post topics, communicate privately with other members, respond to polls, upload content and access many other special features without post based advertising banners. Registration is simple and absolutely free so please, join our community today!

If you have any problems with the registration process or your account login, please contact us.

Please Note: All new registrations go through a manual approval queue to keep spammers out. This is checked twice each day so there will be a delay before your registration is activated.

Go Back   Australian Ford Forums > Ford Australia Vehicles > Small and Mid Sized Cars > Fiesta, Festiva and Ka

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
Old 14-04-2020, 10:44 AM   #1
Luke Plaizier
Lukeyson
Donating Member1
 
Luke Plaizier's Avatar
 
Join Date: Mar 2005
Location: Maitland, NSW
Posts: 2,584
Default WQ Fiesta XR4 Diagnostics/OBD2 Reverse Engineering

Hi All

I'm just going down the path of reverse engineering the diagnostics and data buses on the XR4 - which should be mostly applicable to any WP/WQ Fiesta. I did a bunch of work years ago on the BA Falcon so will be doing the same thing. I just wanted some place to store my findings.

The XR4 had 3 diagnostic networks on board - a High Speed CAN (HS-CAN), a Medium Speed CAN (MS-CAN), and an ISO9141 bus (ISO). The HS-CAN and ISO buses are similar to the falcon, but the MS-CAN bus is on non-standard pins on the OBD2 DLC port under the dash - so I am on the hunt for an ELM327 device with the switchable CAN mode that can be used with apps like FORSCAN.

The process will go along the lines of:

(1) Listen to the down-the-road or broadcast messages on each bus and begin to map changes when I do things in the car - press buttons, open doors, flick switches, change gears, push pedals, latch seatbelts etc. of specific interest is the bus messaging that passes info from the Radio screen onto the Instrument Cluster display.

(2) Capture specific commands as issued by the Ford IDS diagnostic tool and map out the mode, PID and offset/scaling of each.

(3) Programmable modes. Such as enabling/disabling the folding mirrors, or even uploading As-Built data to reprogram a GEM to support auto lights, auto wipers and auto climate. I have another thread where I am doing the physical work for that - but while I struggling with collecting the auto-climate parts, it is time I make serious progress on the diagnostic side.


So far I've only started collecting broadcast messages on the HS-CAN bus. The messages I've seen so far are as follows:

080h, Steering Angle Sensor, I only seem to pickup rate of change, which I might be able to use for the EHPAS power steering pump controller I'm working on. Other users have picked up the actual steering angle, but I don't see that yet.

090h, I think this is from the PCM, I can see some RPM data

200h, from PCM, seems to be 2 values - one with throttle position sensor and another with throttle actuator values. There's another message that also contains what might be throttle position data as well but I have failed to document that yet.

201h, from ABS, I think there are a lot of bitwise fields in this providing stats on what module is present and what features are on or failed, plus some messages on torque reduction

230h, from PCM - seems to be the message for auto-transmission data (selected gear, actual gear, gearshift button position). So I get nothing - not even reverse surprisngly, I thought I would at least get that.

360h, I think from GEM, could be restraints - I haven't seen any movement in this no matter what I do.

430h, might be instrument cluster, seems to have a fuel level field, and might have other fields for IC values (brake fluid level, overheat, coolant eytc)

433h, must be the GEM - I have mapped the door open/close status, door lock status and the wiper, washer, intermittent/auto settings

4B0h, from ABS - gives regular data on the wheel speed sensors.

420h, 428h, 620h, 630h - no idea what these do yet. Not even sure what modules they are from. Nothing changes in them no matter what I do.

None of those messages on the HS-CAN bus have anything in them when the radio display changes, so odds on that data is on the MS-CANbus, which I'll try to look into once I have a diagnostic toolthat I can switch to MS-CAN.

At some point when my data and scaling factors are a bit more accurate, I'll post a link to a spreadsheet with more detailed info.


Lukeyson
__________________
If the human brain was simple enough to understand, we'd be too simple to understand it.

Last edited by Luke Plaizier; 14-04-2020 at 10:50 AM.
Luke Plaizier is offline   Reply With Quote Multi-Quote with this Post
This user likes this post:
 


Forum Jump


All times are GMT +11. The time now is 01:20 PM.


Powered by vBulletin® Version 3.8.5
Copyright ©2000 - 2024, Jelsoft Enterprises Ltd.
Other than what is legally copyrighted by the respective owners, this site is copyright www.fordforums.com.au
Positive SSL