PCMTec Development Blog

Ford information and tools can be found here
Post Reply
User avatar
rolls
Posts: 407
Joined: Wed Sep 07, 2016 11:22 am
cars: bf xr6t falcon

Re: Ford MPC565 Tuning

Post by rolls »

No idea what it supports at this stage but I'm sure I'll find out soon enough!
MeZmeriZe
Posts: 48
Joined: Thu Sep 29, 2016 7:21 pm
cars: 05 XR6T BA with Liquid LPG injection
76 XC Sundowner
91 Surf turbo diesel

Re: Ford MPC565 Tuning

Post by MeZmeriZe »

Wow, quick reply from the Allscanner crew (the VCX guys) very polite and helpful as it turns out.. but their suggestions tie in pretty closely with what I did anyway.

They sent me this: https://money2.biz.uwa.edu.au/franki/PP ... e_Test.pdf which details their test method (the drewtech j2534 tool and a CRO)

It also has this little snippet that is pretty close to the code on the actual ISO SAE doc.

PassThruSetProgrammingVoltage function:
extern “C” long WINAPI PassThruSetProgrammingVoltage
(
unsigned long DeviceID,
unsigned long PinNumber,
unsigned long Voltage
)

DeviceID Device ID returned from PassThruOpen
PinNumber The pin on which the programming voltage will be set. Valid options are:
0 – Auxiliary output pin (for non-SAE J1962 connectors)
6 – Pin 6 on the SAE J1962 connector.
9 – Pin 9 on the SAE J1962 connector.
11 – Pin 11 on the SAE J1962 connector.
12 – Pin 12 on the SAE J1962 connector.
13 – Pin 13 on the SAE J1962 connector.
14 – Pin 14 on the SAE J1962 connector.
15 – Pin 15 on the SAE J1962 connector (short to ground only).
Voltage The voltage (in millivolts) to be set. Valid values are:
5000mV-20000mV (limited to 150mA with a resolution of 100 millivolts for pins 0, 6, 9, 11, 12, 13, and 14).
VOLTAGE_OFF – To turn output off (disconnect-high impedance  500K).
SHORT_TO_GROUND – Short pin to ground (limited to 300mA on pin 15 only).

They also gave me an updated version of the J2534 driver that isn't out yet so I'll try that later.

Incidentally, if anyone finds the text in the J2534 pdf hard to read, I found a txt copy here.. https://archive.org/stream/gov.law.sae. ... 2_djvu.txt It doesn't have the images and has replaced some of them with Gibberish but the text itself is surprisingly good.
User avatar
rolls
Posts: 407
Joined: Wed Sep 07, 2016 11:22 am
cars: bf xr6t falcon

Re: Ford MPC565 Tuning

Post by rolls »

That code is the boilerplate code all J2534 libraries must use and the same as the .NET library I'm using. The DLL call is correct so unsure why it works with mongoose and the OpenPort. Maybe the VCX has a fault?

Something else is to try other pin numbers and see if it is just PIN13 that doesn't work.
User avatar
rolls
Posts: 407
Joined: Wed Sep 07, 2016 11:22 am
cars: bf xr6t falcon

Re: Ford MPC565 Tuning

Post by rolls »

On another topic I've figured out DMR logging for the fords. Ford use completely proprietary commands to log DMRs so not something you could guess easily and requires sniffing. I'll post up more details once I get it 100% working.

RAM is located at 0x300000 (or possibly slightly higher) and hence all DMR addresses are offset to this address. You can see the RAM being accessed by R13 in the binary with an offset added to 0x300000.

Should be pretty easy to get all the speed density, ignition etc DMRs and add them into my program. Map tracing will be MUCH easier than anticipated.

Also got my BDM delivered so might try some in circuit debugging if I can figure out the BDM port though this is probably too much of a distraction for now and I should focus more on the GUI.

edit:DMR logging appears to be done by these commands (not 100% how just yet)

Send A0 0A (enable DMR logging???)
send E0 (Tester Present)
Send E0 00 (Tester present with padding? ISO spec doesn't mention it requires any parameters or padding ????)
Send 21 E5 (READ_DATA_BY_LOCAL IDENTIFIER this is ISO14230-3 not ISO14229 eg an extension of UDS) E5 refers to the LocalIdentifier which has a valid range 02-EF so I assume this is DMR or something like that.
Recieve 7F 21 11 (service unsupported negative response, this may just a generic routine trying all possible methods? I'll try not sending it and see what happens)
Send 3E 01 (Tester present with non ISO spec parameter 01)
Recieve 7E (tester present positive response code)]
Send A0 0A (I assume you have to keep pumping this and tester present to keep the mode enabled)
Recieve E0 (positive response code)
Send A1 01 8C 00 3F 7D 3C (poll battery voltage address 0x3F 79 00 from ram, unsure what the 01 and 8C refer to just yet)
Recieve E1 (positive response code)

Recieve standard can bus message ] 00 00 06 A1 07 E0 01 41 32 75 8D 00 where 41 32 75 8D is ~11.31 volts as a float
Continue to pump 3E 01 and recieve hundreds of can packets per second

The issue I'm having is you must send 3E 01 as a ISO15765 message however the reply comes back as a standard CAN message. I haven't yet worked out how to set up dual listeners one on CAN and one on ISO15765
User avatar
rolls
Posts: 407
Joined: Wed Sep 07, 2016 11:22 am
cars: bf xr6t falcon

Re: Ford MPC565 Tuning

Post by rolls »

Ok seems you can simply pass a second ChannelID into PassThruConnect and simultaneously have two channels operating. Neat.

Still don't quite understand the maskmsg and patternmsg when using PASS_FILTER mode. Anyone understand this? Anyway I've got DMR logging working well enough for a proof of concept so back to working on the GUI it is.

I've also added sniffer capabilities to the alpha proof of concept using a special listener mode the OpenPort 2.0 uses. Very handy for sniffing CAN bus data. They also give you a basic sample C++ sniffer with the OpenPort drivers in the sample folder that you can compile in in VS2015.
User avatar
rolls
Posts: 407
Joined: Wed Sep 07, 2016 11:22 am
cars: bf xr6t falcon

Re: Ford MPC565 Tuning

Post by rolls »

Been playing with avalon dock and got this far. Very basic application that just opens text files but it has a file history and is completely dockable. Very cool API, extremely complex under the hood though. Massive learning curve as I've never formally learnt MVVC (model-view-viewcontroller) which uses databinding for all of the GUI. To be honest I think this is more difficult than the binary editing and flashing code!

Screenshot of what I knocked up. Couldn't think of any good names for the application so open to ideas of something that is free.

With my binary editor/parsing library, the J2534 flashing library, avalon dock and the sample GUI I have 12000 lines of code, without avalon dock ~5200 lines.
Image
User avatar
rolls
Posts: 407
Joined: Wed Sep 07, 2016 11:22 am
cars: bf xr6t falcon

Re: Ford MPC565 Tuning

Post by rolls »

Well have to say I've learnt a fuckload this weekend but the more I learn the more I realise how little I know about making proper GUIs.

Getting there but very time consuming to do even basic things with the MVVC pattern, so much code to write and XAML is quite new to me but I do like how the styles etc work with it.
User avatar
rolls
Posts: 407
Joined: Wed Sep 07, 2016 11:22 am
cars: bf xr6t falcon

Re: Ford MPC565 Tuning

Post by rolls »

Ok well that is enough programming for one weekend.

Image

Took me about 16 hours but I've got a debug log working now, mutiple files can be opened at once and I've linked the flash read/write library in (not completely functional yet) and I've done it as compliant MVVM (model-view-viewmodel) application. Also created a splash start screen and used some random logo generator. Feels pretty good learning something new!

Learnt how to override the windows title bar color themes (not possible through WPF), added theme support as well.
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: Ford MPC565 Tuning

Post by Tazzi »

On a bit of a roll there!!! (Pun intended :thumbup: )
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
MeZmeriZe
Posts: 48
Joined: Thu Sep 29, 2016 7:21 pm
cars: 05 XR6T BA with Liquid LPG injection
76 XC Sundowner
91 Surf turbo diesel

Re: Ford MPC565 Tuning

Post by MeZmeriZe »

Probably a silly question, but figured I'd ask here just in case.. been trying to get BA PCM's working with Rolls.

Pulled the first bank out of a BA turbo PCM (Visteon MPC555 1472) on my bench. I got a 448k Bin file from (0000h - 70000h) but no idea where the second starts. anyone here have a clue on that one?
I must admit I'm surprised to hear that the BF is a single bank and the BA not.
Post Reply