There is no evidence of the diagnostic protocol from the T4 to the Gateway ECU appearing on PWM pins of the diagnostic port that I can see. So it looks like there is no easy way to get around the back of the Gateway ECU and talk directly with Ford protocols as I had hoped. It is almost as if the Gateway has two PWM ports, one that goes to the diagnostic port and one that goes to the engine ECU, so the Gateway ECU converts from Rover (BMW DS2 derived) protocols to PWM on the Mustang ECU, and it also converts from PWM from an EOBD scannner to PWM on the Mustang ECU.
Edit: The above is incorrect. See later post below.
Anyway. I have done most of the work of reverse engineering the T4 protocols for the engine ECU and Gateway ECU. I can already connect to those ECUs so the basic protocol and the security works, it's just a case of finishing off reverse engineering the T4 and implementing in pscan.
One problem I have is that the 260 that I'm working on in Ruislip has no error codes in the Gateway ECU, and so I can't tell how the T4 reads them and decodes them.
Really I need to create an error code in the Gateway ECU. I suppose that pulling the fuse that powers the Mustang ECU would do it? Will this cause any trouble that I can't then easily correct with my T4?
Can anyone suggest any easy, safe and reversible ways to cause the Gateway ECU to log one or more error codes?
I need to do this but I can't take too much risk messing up someone elses car.
Reply With Quote
