Anyone near me want to play with diagnostics?

[pscan.eu]

There is no evidence of the diagnostic protocol from the T4 to the Gateway ECU appearing on PWM pins of the diagnostic port that I can see. So it looks like there is no easy way to get around the back of the Gateway ECU and talk directly with Ford protocols as I had hoped. It is almost as if the Gateway has two PWM ports, one that goes to the diagnostic port and one that goes to the engine ECU, so the Gateway ECU converts from Rover (BMW DS2 derived) protocols to PWM on the Mustang ECU, and it also converts from PWM from an EOBD scannner to PWM on the Mustang ECU.

Edit: The above is incorrect. See later post below.

Anyway. I have done most of the work of reverse engineering the T4 protocols for the engine ECU and Gateway ECU. I can already connect to those ECUs so the basic protocol and the security works, it's just a case of finishing off reverse engineering the T4 and implementing in pscan.

One problem I have is that the 260 that I'm working on in Ruislip has no error codes in the Gateway ECU, and so I can't tell how the T4 reads them and decodes them.

Really I need to create an error code in the Gateway ECU. I suppose that pulling the fuse that powers the Mustang ECU would do it? Will this cause any trouble that I can't then easily correct with my T4?

Can anyone suggest any easy, safe and reversible ways to cause the Gateway ECU to log one or more error codes?

I need to do this but I can't take too much risk messing up someone elses car.

[SCP440]

One of the mechanics I know used to work for Kernahan's in Witney, this was a MGR dealership and they sold several 260's. He was telling me some 260's had to go back to the factory as some faults were unfixable at the dealerships even though they had all the tools and diagnostic software.

Interstingly they had one car with a heater stuck on hot that ended up going back to the factory.

Steve

[pscan.eu]

Pulling the ABS fuse created some error codes

I looked at the wiring diagrams and my above assumptions are wrong. The OBD port does connect straight to the Ford ECU. I also tried a different scan tool in Ford mode and I was able to get it to connect; I guess that the other one wasn't good enough.

Therefore I should be able to implement a mode that goes straight into the Ford V8 ECU without going via the Gateway ECU as the T4.

Anyway, I have already gotten the Gateway ECU protocol working. These are the screenshots:-

V8 Gateway ECU







I think that the numbers for Revs and Coolant temp are a bit off, I need to re-check them.

X12 V8 Engine ECU (in T4 mode - via the Gateway ECU)






I haven't finished reverse engineering all the live data parameters (there are lots) yet. I will update when that's done.

[pscan.eu]

One other thing to note is that the protocol runs a bit slower in a real car than it does with just the ECU on a bench.

In the car you can talk directly to the ECU in Ford mode but the Gateway ECU is still there chatting away on the same databus, and I think that this slows things down, or, you can go through the Gateway ECU but then you are talking to one ECU through another, which also slows it down.

[pscan.eu]

I did some testing today with the first 25 or so parameters that I reverse engineered using a Ford tool on a Mustang 4R3 ECU.

This is pscan (dev version) connecting to the Mustang ECU


This is the same software talking to a ZT 260


The numbers will be different because the Mustang ECU is on the bench with no sensors, whereas the ZT 260 one is installed in a car....

The interesting thing is that one of the parameters (valid drive counter) is unreadable on the ZT 260 but it works on the Mustang.
Another is that certain parameters such as the fuel cap signal don't seem relevant to the ZT 260.

So, whilst I can pull more data from the ECU using Ford "language" I'm not sure that it's actually that useful.
I think for the time being I should concentrate on reading the data that a T4 can read rather than what a Ford tool can read.

The good news is that on the ZT 260 I was able to get into the ECU directly using the Ford data lines on the diagnostic socket. The picture above is doing that.

This picture below is using the same parameters (so reverse engineered from a Ford tool on a Mustang ECU) but through the Rover pins on the diagnostic socket to the Gateway ECU:-


This is good news. It means that pscan should be able to read straight from the engine ECU even if say the Gateway ECU has a problem.

I think that I'm nearly there.

[Pete]

Hi Philip
This is the first time I have used the pscan on my MG ZT 260 as my engine warning light came on today. The software loads and works fine. There are two software format selections named Ford and T4. First question is why are there two and what are the differences?
Running the program shows a fault code P0138 Sensor Circuit High Voltage (Bank 1 Sensor 2). If I run the Ford format it says misfire not detected yet the T4 states detected. Should I be using only one? If so which one?

Please see attached readout with the O2 reading variations all at tickover;
Bank 2 U/S O2 Heater fluctuates between on/off
Bank 1 U/S O2 Volts fluctuates between 0.06/0.83
Bank 1 D/S O2 Volts steady at 1.67
Bank 2 U/S O2 Volts fluctuates between 0.05/0.81
Bank 2 DS O2 Volts this climbs slowly from 0 to 0.9 but returns to 0 if the revs are lifted.
Listening to the engine there appears to be an intermittent misfire?? a put put sound at the exhaust.

I am aware that the error code could be caused by

1. the sensor
2. wiring/connections
3. leaking injector
4. catalyst

What would be a logical fault finding procedure based on the above data?

o2.jpg

[Rogerson]

Did you run it more than once, Pete?

[Pete]

Kevin please see this thread which was moved to Technical in main forum https://www.two-sixties.co.uk/mgoc26...nk-1-Sensor-2)