WQ Fiesta XR4 Diagnostics/OBD2 Reverse Engineering

[Luke Plaizier]

Hi All

I'm just going down the path of reverse engineering the diagnostics and data buses on the XR4 - which should be mostly applicable to any WP/WQ Fiesta. I did a bunch of work years ago on the BA Falcon so will be doing the same thing. I just wanted some place to store my findings.

The XR4 had 3 diagnostic networks on board - a High Speed CAN (HS-CAN), a Medium Speed CAN (MS-CAN), and an ISO9141 bus (ISO). The HS-CAN and ISO buses are similar to the falcon, but the MS-CAN bus is on non-standard pins on the OBD2 DLC port under the dash - so I am on the hunt for an ELM327 device with the switchable CAN mode that can be used with apps like FORSCAN.

The process will go along the lines of:

(1) Listen to the down-the-road or broadcast messages on each bus and begin to map changes when I do things in the car - press buttons, open doors, flick switches, change gears, push pedals, latch seatbelts etc. of specific interest is the bus messaging that passes info from the Radio screen onto the Instrument Cluster display.

(2) Capture specific commands as issued by the Ford IDS diagnostic tool and map out the mode, PID and offset/scaling of each.

(3) Programmable modes. Such as enabling/disabling the folding mirrors, or even uploading As-Built data to reprogram a GEM to support auto lights, auto wipers and auto climate. I have another thread where I am doing the physical work for that - but while I struggling with collecting the auto-climate parts, it is time I make serious progress on the diagnostic side.


So far I've only started collecting broadcast messages on the HS-CAN bus. The messages I've seen so far are as follows:

080h, Steering Angle Sensor, I only seem to pickup rate of change, which I might be able to use for the EHPAS power steering pump controller I'm working on. Other users have picked up the actual steering angle, but I don't see that yet.

090h, I think this is from the PCM, I can see some RPM data

200h, from PCM, seems to be 2 values - one with throttle position sensor and another with throttle actuator values. There's another message that also contains what might be throttle position data as well but I have failed to document that yet.

201h, from ABS, I think there are a lot of bitwise fields in this providing stats on what module is present and what features are on or failed, plus some messages on torque reduction

230h, from PCM - seems to be the message for auto-transmission data (selected gear, actual gear, gearshift button position). So I get nothing - not even reverse surprisngly, I thought I would at least get that.

360h, I think from GEM, could be restraints - I haven't seen any movement in this no matter what I do.

430h, might be instrument cluster, seems to have a fuel level field, and might have other fields for IC values (brake fluid level, overheat, coolant eytc)

433h, must be the GEM - I have mapped the door open/close status, door lock status and the wiper, washer, intermittent/auto settings

4B0h, from ABS - gives regular data on the wheel speed sensors.

420h, 428h, 620h, 630h - no idea what these do yet. Not even sure what modules they are from. Nothing changes in them no matter what I do.

None of those messages on the HS-CAN bus have anything in them when the radio display changes, so odds on that data is on the MS-CANbus, which I'll try to look into once I have a diagnostic toolthat I can switch to MS-CAN.

At some point when my data and scaling factors are a bit more accurate, I'll post a link to a spreadsheet with more detailed info.


Lukeyson

[Luke Plaizier]

So today I managed to spend some time on the MS-CAN bus. I learned quite a lot today too - about how J2534 devices (USB devices that plug into the OBD2 port) can actually manually change which pins they talk on, and that they can establish multiple concurrent sessions on up to 4 different buses.

The HSCAN bus presents on two standard pins on the DLC OBD2 port under the steering wheel - CAN High line is on pin6, and CAN Low on pin14. This HSCAN bus is a 500kbps 11bit CAN protocol. The MSCAN bus presents on the pins that used to be used for the Ford PWM protocol - which I think was used on the EA and onwards and perhaps the AU falcon. It presents on pin 3 for the CAN-H and pin 11 for the CAN-L. The MS-CAN bus is also an 11bit addressed bus, but it runs at 125kbps.

In the XR4 Fiesta, the modules on the HSCAN bus are: ABS, PCM, Instrument Cluster and two modules used by the European robotic manual IB5 transmission. The workshop manual also says that the Electro Hydraulic Power Steering from the LS Focus is on this bus too - so like Cruise Control it looks like this was in development for the CBK Fiesta/Fusion but never made it to production before development of CB1 started.

The modules on the MSCAN bus are: Instrument Cluster (This is the bridge between the two CAN buses), Restraints Module, EATC - auto climate control, Audio Module, Blue Tooth/Voice Recognition Module (Europe Only), GEM body control module.

There's also a 1-wire ISO9141 bus that still seems to be used, with the Restraint and ABS module still doing some things on that bus.

Now, for the MSCAN stuff, there seems to be an absolute shyte load of messages on this one. Some of them are the same as those on the HSCAN bus, and must pass through the instrument cluster to get there. Most are unique to the MSCAN bus. There appear to be quite a few more broadcast messages on the MSCAN bus than are on the HSCAN bus.

The full list of messages and their header addresses is as follows. I have yet to attempt to map anything out. For many of these I found bits changing when I pressed buttons on the Audio module, and I think I've found the messages that send the 8 characters of text to the instrument cluster, so that's looking pretty good now.


023, 080, 201, 210, 265, 285, 286, 2A5, 2D5, 2D8, 2D9, 2DA, 2DB, 2DC, 2E3, 2F4, 360, 410, 420, 428, 433, 460, 499, 4C0, 4D0, 4D7, 4F2, 4F3, 501, 50C, 511


Luke

[Luke Plaizier]

Spent some time pulling fuses (ABS,RCM) or pulling connectors (ACM,IC,GEM) to see what modules were responsible for sending what messages. I have a table and I took some goes at getting it into a message on this site, but couldn't get it to work... I'll have to try something else.



Luke

[Luke Plaizier]

Tried all I could to make a table in HTML. Getting the table into Word and saving as HTML made a table so big it was too big to post here.

So lets try this:

https://docs.google.com/document/d/1...it?usp=sharing


Luke

[Luke Plaizier]

This is a link to my attempts to reverse-engineer the CAN-ID broadcast messages for our 2007 WQ Fiesta XR4. Work in progress, so it will change.

2007 WQ Ford Fiesta XR4/ST150 CAN IDs

Luke

[Luke Plaizier]

Well, some good news to report. I have some other threads on the go regarding additional features and the like. I've found out how to do the reprogramming on the GEM, which is the module that controls the Body functions. I have the values now for enabling/disabling the following features.

* Powerfold Mirrors
* Auto lights
* Auto Wipers
* Factory Alarm vs Thatcham alarm
* 3dr / 5dr bodyshell

There's also a bunch of other settings, like the drip wipe, follow-me-home lights, auto flashing brake lights on hard deceleration (used a lot on UK freeways), courtesy lamps, one/two keyprsses for boot unlock, 1/2 keypressed for drivers/passenger door unlock, Tailgate open sensor, bonnet open sensor etc.

Happy days.

It turns out that there are 4 types on GEM in total. A, B, C and D. The A and B are for models that are low spec, and C is for just about all the features bar the Thatcham Car alarm and double-locking doors, which is what the D version is for.

I still have a bunch of PIDS to pull out of some modules - like the PCM, ABS and RCM (Restraints) but I have everything I need from the ACM (It's a CDC 6006, but without the bluetooth, so I am probably missing any bluetooth settings), IC and GEM are done. In the next few weeks I am planning to do some bench-powered testing of the Auto Climate module to map it out, and I have a Ford Focus Electro-Hydraulic Power Steering Pump that I'll be looking to power up and get some data from. Beyond that I have a friend with an LS Focus, and we've chatted about swapping cars for a weekend so I can collect some stats from his car - namely any options to do with Cruise Control, and what messages are being broadcast that are stimulating the Power Steering pump into action.

I have some Arduino bits on the bench at the moment and am experimenting with whether I can use that to get Cruise/Ehpas enabled in a WQ Fiesta..... fun times indeed.


Luke

[Luke Plaizier]

The HS-CAN bus on the Fiesta is a 500kbps, 11bit bus, that presents on the standard pins on the OBD2 port. HSCAN+ is pin 6, HSCAN- is pin 14. The bus needs a terminating device at each end - teh PCM is at one end and the IC is at the other.

HSCAN Broadcast Messages: PCM, IC, ABS, (EHPAS)
HSCAN Diagnostics & Programming: PCM, IC, (EHPAS)

The MS-CAN bus on the Fiesta is a 125kbps,11bit bus, that presents on 'Vendor Option' pins on the OBD2 port. MSCAN+ is pin 3, MSCAN- is pin 11. You can't get to these pins using a normal cheap ELM327 tool, unless it has been modified to be 'switchable' between the two. J2534 tools, if the full API is implemented, can switch pins using an API call. So too can voltage be applied if needed.

MSCAN Broadcast Messages: IC, GEM, ACM, RCM, (EATC)
MSCAN Diagnostics & Programming: GEM, ACM, (EATC)

The ISO9141 is a 10.4kbps bus that presents on the standard pins too - the K Line on Pin 7.

ISO Diagnostics & Programming: RCM, ABS

The names and the modules and their addresses for diagnostics and programming are as follows:

IC = Instrument Cluster. Target ID=0720h on both HSCAN and MSCAN
GEM = Generic Electronics Module. ID=0726h on MSCAN
ACM = Audio Control Module. ID=0727h on MSCAN
EHPAS = Electro Hydraulic Power Assisted Steering. ID=0730h(?) on HSCAN. To be confirmed.
EATC = Electronic Automatic Temperature Control. ID=0733h(?) on MSCAN. To be confirmed.
RCM = Restraints Control Module. ID=58F5h on ISO
ABS = Antilock Brake System (+ESP). ID=28F5h on ISO.

Each module sends out a series of broadcasts, and those broadcasts contain various bits of information that can be read by other modules. An overview of the broadcast messages, the source and what is contained in them are listed in a link in a previous post to a google sheets document.

Luke

[Luke Plaizier]

For the EHPAS module, the reference material I have shows that one message is required to turn it on. There's a single bit in that message which, if set, tells the EHPAS motor to start running. The EHPAS also listens for two other values - Road Speed and Steering Angle rate of change. Both get used to determine how fast the pump should run. If the speed is low, the pump speeds up. If the steering wheel is turned suddenly, the pump speeds up. In all other situations, the pump slows down.

Broadcast messages look like the following - a header that is used for priority and arbitration, and then a bunch of data. Determining which module sends which messages is an exercise in reverse engineering. I was pulling fuses or disconnecting modules and seeing which messages disappear.

00 00 00 80 27 10 75 30 01 30 77

This message comes from the PCM, but it uses data from teh Steering Angle Sensor in the Clockspring.

The 00 00 00 80 is actually a 29 bit address. As an 11 bit address it looks more like 080.

The next 8 bytes are the data in hex.

2710h is 10,000 decimal. I think the actual steering angle would go here, but the XR4 doesn't populate it. It hasn't changed in all of the testing I've done.

7530h is 30,000 decimal and is the steering rate of change. Turn left and the value increases, depending on how fast it is turned. And turn right and the value decreases below 7530h.

The very last field, 77, is continuously incrementing, so looks like it gets used to index the messages. Indexed messages means it can detect when messages get dropped, and also make it hard to 'inject' other messages into the stream.

Which leaves 0130h. In binary thats 0000 0001 0011 0000. My documents suggest that that two those bits set to 1 is telling the EHPAS to turn on. There are 3 other bits there potentially telling me whether the Steering Angle Sensor is fine or has been initilaised.

There will no doubt be other messages involved, but what I see in the Fiesta doesn't match withmy documents just yet. For example, my documents say 080 should also have vehicle speed - but I haven't seen it. HOWEVER, so far I have only done my speed tests with the wheels off the ground on my hoist - which the ABS module doesn't like having wheels all go different speeds. I'll do some down the road tests shortly. WHat is encouraging is that the message that is SUPPOSEDto show speed for the INsrument cluster, is also showing 2710h. However, I did see the speedo dial move while on the hoist. More attention andanalysis required.

I DO, however, have a possible broadcast message that the EHPAS module might send, that includes a 'pump fail' message. The message is 240h - and is not currently present in the car, which makes sense. I have a Focus EHPAS pump here, and will attemp to power it up in the coming weeks and hook it up to a CAN tool to see if it is issuing broadcasts. But it's that Pump Fail message that may be responsible for lighting up the 'EHPAS' light on the instrument cluster, in the lower right of the Tacho dial.


Luke

[Luke Plaizier]

There's another broadcast message that might be of interest to some people on the MSCAN bus. This message is sent out by the factory Audio module and received by the Instrument Cluster. It consists of two messages one after the other using the same ID.

MSG1 is sent every 500ms, and MSG2 is sent 50ms after MSG1.

The header for this message is 4C0. After I change the volume to level 4, I see these:

MSG1: 00 00 00 04 C0 10 09 34 20 56 4F 4C 20
MSG2: 00 00 00 04 C0 21 34 20 00 00 00 00 00

Remove the 29 bit address from each to get this:
MSG1: C0 10 09 34 20 56 4F 4C 20
MSG2: C0 21 34 20 00 00 00 00 00

The bytes of interest are these:
MSG1: 20 56 4F 4C 20
MSG2: 34 20 00

Which in ASCII is:
MSG1: Space V O L Space
MSG2: 4 Space

Or another

MSG1: 00 00 04 C0 10 0A 34 31 30 32 2E 31
MSG2: 00 00 04 C0 21 20 46 4D 00 00 00 00

1 0 2 . 1 SPACE F M

MSG1: 00 00 04 C0 10 0A 34 48 4F 50 45 31
MSG2: 00 00 04 C0 21 30 33 32 00 00 00 00

H O P E 1 0 3 2


Space V O L Space U P

Space V O L Space D N

N O V A Space 9 6 9



Etc etc etc.


I can provide directions on how to use a cheap ELM tool to receive these messages, and potentially manually send out at least one message - if there is anyone interested...


Luke

[Aaron]

Thanks Luke for the Audio system coding.



My objective is to use an an Arduino to write short simple messages to the information display (just like the Radio does). I've seen this done by someone else in a VW? (was a random Youtube video years ago) and felt it was a neat compromise between aftermarket gauges and wanting more info in the car.


For example using the Arduino Analog input to read a combined oil temperature and pressure sensor and being able to display that on the cluster. Likewise the Arduino can control the oil pressure warning light on the dash based on those inputs!


We can naturally extend that idea to displaying anything we read from the Canbus, or that the Arduino can interface with in a timely manner.



I'll add to this thread as I get myself in gear and start playing around.

[Luke Plaizier]

I've had some fun today. Not sure if this fits into the CAN bus thread or the 'Features not available in Oz' thread, but given my activity is mainly CAN based, here it is.

I have a Focus EHPAS up on the bench. I planned up and assembled a lab wiring setup on it today - using big yellow 9mm pins from Jaycar for power, and some cheap connectors from Aliexpress for the CAN plug. My first breakthrough is seeing the broadcast messages from just that module - 240. It's only short - and my data says that is mainly about pump status. There's a Jewel on the Instrument Cluster for the EHPAS, so I might experiment with an IC later and fiddle with bits in 240 to trry and turn on that Jewel. At the moment I am doing a full PID sweep on the pump - from 0000 to FFFF, so all 65536 PIDS at 100ms intervals, which should take just under 2 hours. The next is an offset sweep of all FF offset locations - of which I only expect to see a half dozen down the bottom. All the as-built stuff sits down there on other modules.

So in a few hours, I'll be trying to send some fake messages using the 080 address, to see if I can wake it up.

Last week I took a drive the XR4 with the eldest driving while capturing data, and confirmed message 080 is working correctly. The first 2 bytes are definitely Roadspeed, the next two bytes are definitely Steering Rate of Change, and the 5th Byte seems to be a bitwise field that changes when the car turns on - which looks like it will be the bits that turn the EHPAS pump on. Since the ehpas only cares about roadspeed (high pump speed at low rtoadspeed for parking) and steering rate of change (max assist while you're turning) then it is looking very good so far.

Fingers crossed.



I have wired this up in such a way that I can plug it all into the OBD2 port on the Fiesta, to see if the pump will spin up using the messages that are already there.


Lukeyson

[Luke Plaizier]

Message 240 gives me the following:

02 40 00 60

So just 2 bytes. I'm betting that it's a bitwise value. The pump is not running when I get this message, so I'm betting the bits will be indicating pump fail. So the bits are:

0000 0000 0110 0000

Lukeyson

[Luke Plaizier]

[Luke Plaizier]

So of the 65 thousand PIDS, I pulled out about 37 active ones. I know what about 16 of them are from the data on other modules I have. But there's still a bunch of pids with data in them I don't know how to resolve yet. I have a few steps with Forscan and IDS to try which might reveal more info.

This whole reverse engineering sleuthing game is so much fun....


Lukeyson

[Aaron]

One of the odd bits of (I presume bad) information kicking around some forums are that these pumps will kick into a constant speed mode when an IGN-ON signal is applied, apparently there’s a “delay” of sorts because the pumps electrical load has the potential to brown out weak batteries. I’m sure that life’s not that simple, but then again how many variants of these basic pumps exist and maybe there is a version that does do it.

[Luke Plaizier]

Intial tests have not proven fruitful. I have attempted to send the 080 messages at 80km/h and the steering wheel static, but the pump has not spun up. Yet. I have quite a few more things to try.

Yeah, I was cautious of the pump spinning up on it's own. I was careful to mount it and clamp it down before I applied any power, so I didn't have any expected launches into life. The M10 150mm glavanised bolts from bunnings are just long enough with the copper pipe cut to hold it about 5mm off the ground.

Since I'm getting broadcast and PID responses I'm pretty confident that the wiring is right. The rest is up to me to sleuth the message that turns it on.


Lukeyson

[Luke Plaizier]

With the Focus EHPAS patched into the WQ Fiesta HSCAN bus via the OBD2 port - the unit powers up when the car is started! It starts slow first, then begins to ramp up, but then stops part the way up the ramp, drops speed again, and starts pulsing in some fashion. Doesn't sound great to be honest. My power supply is only 30A, so it might be a supply limit perhaps. But it could also be much more - a PATS detection perhaps, or a fail mode since it can't find the Steering Angle Sensor on the 3rd connector.

The fight continues....


Lukeyson

[Aaron]

Do you have fluid in it?

And does that fluid have anywhere to go?

[Luke Plaizier]

Nope. And Nope. But I've seen video's of bench top tests doing something similar to what I've done. Pity they kept all the CAN messages to their chest. I certainly won't be if I find them.

or



I had a bunch of work to do in the yard over the long weekend so didn't get to followup on the EHPAS the additional testing I wanted to do just yet - it's all documented for when I next get a chance. What I was excited to do was get the same baseline wiring test setup going for some EATC auto climate modules that I have here - the single mode Fiesta Mk6/Mondeo Mk3 auto climate, the LS Focus Dual Zone Climate and a LT Focus Cabrio Dual Zone Climate. I haven't had as much success there.

I have a wiring loom for testing, and while I can get the Illumination on in each module, and the Actuators all power up and test (outlet register, recirc, temp etc), I can't get any of the modules to actually come alive. I've done a lot of wire troubleshooting and so far nothing on the CAN bus. I can't go into the 'eatc test menus' that are listed online because the modules never wake up. I don't have a blower motor correctly hooked up yet due to slight differences between the modules so that would be next. And I might also connect to the WQ can bus to see if that wakes it up - it too might be looking for CAN bus messages.


Lukeyson

[Luke Plaizier]

So this is an Excel plot of the bytes of data that come from the EHPAS pump during one of my runs powering it up connected to the XR4 Can Bus.

The trace started with power applied to the pump, but the vehicle off.

At around msg 1350 I turn the ignition on, at which point the CAN bus messages from the car started in the KOEO state. (Key On Engine Off).

At around msg 2777 I fired up the car and let idle - in the KOER state (Key On Engine Running). There was a slight delay, and the EHPAS unit was heard to power up and settle at a constant speed for a short period of time. Then the EHPAS unit seemed to speed up, reach a certain speed, and then drop. As discussed above. Then it seemed to pulse. This ramping and pulsing can be seen in the Pump Speed trace.

The other line in the trace is the bitwise field - normally 0110 0000. . But of note is the jump when the pump starts to ramp up - which changes the bitwise value to 1110 0000. So I'll note that down in the 'interesting' column until such time as I can do a full capture on an LS Focus.




Lukeyson

[Luke Plaizier]

Listen for the comment "Building Pressure in the Lines". That might be a clue for me to listen Aaron more....




Lukeyson

[Luke Plaizier]

Hmm.

I've never seen Feeonnaa before, but looking at the quality of her work, and her clearly very knowledgeable and precise presentation skills, I now want to see more of what she's done.




Lukeyson

[Luke Plaizier]

I posted in one of the other threads how I had some success getting the ETAC modules to power up in my lab environment - thanks to my loom that interfaces to an OBD2 connector, which can be patched into the WQ OBD2 port. I thought I had best share the wiring setup I had for my test loom - it's showing mainly how I am interfacing the EATC module and does not visually represent the OEM LS loom itself - other than the loom desgination and colour from the table. For reference, the table shown is for the WQ Fiesta Single ZOne EATC module. I'll dig out my comparison of pinouts to the LS EATC module.




Luke

[Luke Plaizier]

This might not work on this page. I'll give it a go.

WQ vs LS vs LT EATC connector pin comparison.




Lukeyson

[Luke Plaizier]

Hmm. These EATC modules are elusive buggers. The controller in the WQ fiesta seems like it's from the stone age - very slow, struggles to respond. I issue queries to about 3 or 4 PIDS in succession, and it seems to go into a sleep mode for a few seconds before responding again. I tried a PID sweep and the scanner would keep increment the queries but I'd not get responses from good chunks of them until the module started to respond again.

The LS EATC module was a lot quicker, so I setup a PID scan. But I got back to it a few ours later after it had run through all 65536 PIDS and not one of them responded. I am assuming I made an error of some sort and have yet to go back and find out what I did wrong, since I can query PIDS with FORSCAN can get valid data from them just fine.

On another note, I grabbed a used WQ power steering rack on the cheap today, so will make up some hosing and do some more Focus EHPAS tests in a little while with the system able to come up to operating pressure.


Luke

[Aaron]

Don’t forget the Fiesta senses power steering fluid pressure on the line near the rack, so the ecu seeing pressure (or change in pressure state) may be the simple thing that is needed to make the ecu run the pump correctly. Otherwise I could see an engineer logic of
“run pump”
“Is there pressure”
“If yes then idle pump until steering movement/pressure change”
“If no and we haven’t seen pressure in KOEO cycle then assume epic system fail, shutdown pump”

[Luke Plaizier]

Possibly

My understanding of the pSteer pressure switch was to detect extended pressure excursions and bump the idle to compensate - like when you're at full lock and are on the bump stops. It's on everything with or without EHPAS. You might be right, but I'm going to proceed assuming that the check for fluid pressure is in the pump itself. One of the videos in the preceding links was a motivator for me - that the pump is seeking to prime itself and see pressure so it can enter a steady state.

Installing one of these pumps and linking to one of the CAN buses at this point should ALREADY be viable for anyone with an XR4 - give me a bit of time and I'll check it runs on a 1.6 as well. It will change speed with RPM so should be good for parking, and low engine drag at high RPM. Rapid steering turns at high RPM - maybe not so much.


Luke

[Aaron]

Luke, I am looking at a bundle of Auto-wiper and Auto-lights parts which have come up for a seemingly reasonable price. As I’ve now got a OBDLinkEX I can do all the Forscan stuff without dealing with ELM327 switching and baud rate quibbles .

Are “we” in a position now to activate the auto functions without too much risk or difficulty?

I would be keener to know if there’s cruise control buried in there somewhere as it looks a lot like Mk2 Focus Audio and Cruise co trim stalks would fit in the place of our Fiesta Audio stalk (although that $100 I’m not sure Id want to take the punt given that’s 15% of a aftermarket setup).

[Luke Plaizier]

Auto Wipers and Lights - I'd done all the research and was pretty confident it can be done, but hadn't yet put it to action.

Without getting the right roof loom there's some stuff to be done adding wires up there for the sunlight/rain sensor. I remember checking the body loom side of the connector on the A pillar and it had all the wires, so it was just the rood loom missing pins.

One minor query will be whether the windscreen blackout around the rear vision mirror can be scraped away to allow that sensor to see out.

Turning the features on in the GEM in Forscan is a no brainer. And the intermittent wiper setting on the stalk actually becomes the rain sensor sensitivity.

One thing I can't recall is if the XR4 dash loom has the pins for the auto lights setting at the back of the light connector - I think it did but I'm admittedly a bit fuzzy on that.

What parts did you manage to find?


Luke

[Aaron]

It’s a full set with roof loom, covers, sensor, mirror and headlight switch. I’m willing to take a “punt” on the package as there’s enough there to have it installed and look “complete” while I work out any missing wiring.