FORD technical service bulletin : ICC touch screen display

[Superb]

Originally Posted by JasonACT

I'll consider it. My comments to the person who I developed this for was, there's a very limited number of uses for this (only a handful of Cluster firmwares were created, and I've got a bunch of them already)... There's only one left that I'm really interested in (the GTF, which has a confirmed different Signal Configuration to the other FG2s).

Hey JasonACT, I have the GTF dash in my mk1 F6 that I did a FGX conversion a few years ago. If you still need the firmware I can share it with you once I get a proper ELM327. I have an old switched one that I can't find atm + VCX Nano & Tatrix Openport

I can't believe how far you have come with this, great job. It was many months ago since I last looked.

[JasonACT]

Hi Superb, my preference is to load it up on github with the other firmware files, so anyone can get it if they need it (eg. to rebuild a broken Cluster, with all the correct files, much like the ICC files already there). I've decided not to use it myself, since I've already added things to my ICC that are beyond what you get with the GTF firmware (64KB signal config is the important bit, the larger 400KB exe part is the same as in a normal Cluster). But that's not to say I'm not interested in seeing what the differences in the files are though! So it would be much appreciated. Who knows, it might be possible to expand what it does, with a bit of editing (signal config is all data and well structured).

[JasonACT]

I might as well add this here:



Since I already did the work on it. And that the software will now let you save an image that's been processed through the B&W algorithm, so that was easy.

Also, since this thread was never moved to the FG forum, I should mention this software should work on the SZ and SZII.

[JasonACT]

Originally Posted by jakka351

Stop! Police! You're under dressed.

I guess we'll see soon, but that might be because his pants caught fire.

[jakka351]

Originally Posted by JasonACT

I guess we'll see soon, but that might be because his pants caught fire.

Stop! Drop and Roll!

[Superb]

Originally Posted by JasonACT

Hi Superb, my preference is to load it up on github with the other firmware files, so anyone can get it if they need it (eg. to rebuild a broken Cluster, with all the correct files, much like the ICC files already there). I've decided not to use it myself, since I've already added things to my ICC that are beyond what you get with the GTF firmware (64KB signal config is the important bit, the larger 400KB exe part is the same as in a normal Cluster). But that's not to say I'm not interested in seeing what the differences in the files are though! So it would be much appreciated. Who knows, it might be possible to expand what it does, with a bit of editing (signal config is all data and well structured).

Yes all in the name of preservation.
I'm happy to share it once a get a new ELM as I found my old one and it doesn't work correctly with your software.
I should have known it was a clone. A long time ago I flashed the firmware on a Focus IPC and the only way it would complete without errors was if it was direct wired to the cluster.
Recommendations on where I can get one?

[JasonACT]

Forscan makes some permanent changes to the non-volatile-memory settings inside an ELM (or clone) which may make it suddenly work (To be honest, I don't want to do that change myself, since the owner doesn't know what's being done)... But if your ELM came with a physical switch, it probably will work, if you test out Forscan first through to the MS switch setting.

[Superb]

Yes it has a switch and has always worked with Forscan.
It will connect but all I get is this
ATZ
ELM327 v1.5
ATM0
OK
Increasing the Security Level
CAN ERROR
CAN ERROR
CAN ERROR
CAN ERROR
CAN ERROR
CAN ERROR
CAN ERROR
CAN ERROR
CAN ERROR
CAN ERROR
Failed to enter secure mode

[JasonACT]

Have you got the latest version off github? There's a check now in the software that the settings are right... If that doesn't work then searching ebay for Forscan ELM327 will generally give you the right items to buy. *** not bluetooth though ***

[Superb]

Yes latest version and the dongle is USB. Its hard not to buy a clone on eBay, I see what I can find. Thanks

BTW this is what I have now
https://www.ebay.com/itm/272851989367

[jakka351]

Originally Posted by JasonACT

Have you got the latest version off github? There's a check now in the software that the settings are right... If that doesn't work then searching ebay for Forscan ELM327 will generally give you the right items to buy. *** not bluetooth though ***

I can confirm overpriced bluetooth dongle from that electronics will work with this - It doesnt read the ms-can pins though. But If you wire the ms can to the hs can pins on the dongle, will happily play with 125kbps.

Yes. I bluetoothed the eeprom out of my daily driven FPV cluster.

[jakka351]

Originally Posted by Superb

Yes it has a switch and has always worked with Forscan.
It will connect but all I get is this
ATZ
ELM327 v1.5
ATM0
OK
Increasing the Security Level
CAN ERROR
CAN ERROR
CAN ERROR
CAN ERROR
CAN ERROR
CAN ERROR
CAN ERROR
CAN ERROR
CAN ERROR
CAN ERROR
Failed to enter secure mode

Connect to forscan, let it read hs, then switch do a ms can read. Quit Forscan. Open Other program.

[JasonACT]

It's weird, that's for sure - I knew people found it hard to get an ELM dongle that works with Fords, and I guess it's my fault for not wanting to program up the right settings (but in saying that, I know Forscan will not change a setting if it's reporting that it is correct already). I had to reset mine back to "factory" before I could see which options were turned on in the non-volatile-memory, long after the fact. I do like these Forscan guys - and I'm not intending to ever include firmware programming since they do it so well already.

But, yeah, what you're seeing should not be happening.

[Superb]

Originally Posted by jakka351

Connect to forscan, let it read hs, then switch do a ms can read. Quit Forscan. Open Other program.

Thanks but I did already try that. But you got me thinking of swaping the pins over. I've already cracked it open

[jakka351]

Originally Posted by Superb

Thanks but I did already try that. But you got me thinking of swaping the pins over. I've already cracked it open

Oh you dont have to open it. I made a little loom that plugs was female obd and male obd, with the hs and ms hi and low wires swapping between plugs.

[jakka351]

Originally Posted by Superb

Thanks but I did already try that. But you got me thinking of swaping the pins over. I've already cracked it open

Are you selecting MK1 or MK2 as appropriate for your vehicle - as that will also cause security access error.

[Superb]

Originally Posted by jakka351

Oh you dont have to open it. I made a little loom that plugs was female obd and male obd, with the hs and ms hi and low wires swapping between plugs.

It all good, I had already opened it up today to verify if it was a clone or not but yeah I actually did what you said with my patch loom.

ATZ
ELM327 v1.5
ATM0
OK
Increasing the Security Level
ERR94
ATSH720
ATR1
021001
7F 02 11
021002
021002
7F 02 11
ATR0
ATSH7DF
023E80
ATSH720
ATR1
021002
7F 02 11
021002
7F 02 11
ATR0
ATSH7DF
023E80
ATSH720
ATR1
021002
021002
CAN ERROR
Failed to enter secure mode

[JasonACT]

That's more like it!

But...

I recently told the ELM327 to not include spaces in replies... And you have got them in spades... So your ELM clone is too old (ELM never made a v1.5 and they make that quite clear in their doco - and all clones say v1.5 but what you really have is a bit old and random and not really something I can support).

[Superb]

That's ok, I just seen your post.
I've ordered a new one. I'll report back when it arrives.
It's local stock so hopefully by next week.

https://www.ebay.com.au/itm/USB-FTDI...154756-20017-0

Thanks

[JasonACT]

Looks just like mine

[jakka351]

Originally Posted by Superb

It all good, I had already opened it up today to verify if it was a clone or not but yeah I actually did what you said with my patch loom.

ATZ
ELM327 v1.5
ATM0
OK
Increasing the Security Level
ERR94
ATSH720
ATR1
021001
7F 02 11
021002
021002
7F 02 11
ATR0
ATSH7DF
023E80
ATSH720
ATR1
021002
7F 02 11
021002
7F 02 11
ATR0
ATSH7DF
023E80
ATSH720
ATR1
021002
021002
CAN ERROR
Failed to enter secure mode

Do you have a mix of Fg1/Fg2/Fgx modules in your car

[JasonACT]

^^^- That ELM doesn't even allow me to turn echo off!

[Superb]

Originally Posted by jakka351

Do you have a mix of Fg1/Fg2/Fgx modules in your car

Yes but that output was direct from my spare cluster on the bench

Originally Posted by JasonACT

Looks just like mine

Sweet

[jakka351]

Hi private message sender regarding this thread,


Just for the record...it seems my sense of humour regarding Police Mode has confused some into thinking I am making a joke at their expense. If you are made uneasy by my silly comments (yes they are just jokes, and barely even funny if that), I ask you one question.


I'm not holding a gun....but why are you so triggered?


Please lighten up, everyone can get along there are no teams or agendas just people doing what they enjoy.






SO.
STOP
DROP
and ROLL

[JasonACT]

Sheesh, some people! I'm sorry to hear that sad story Jakka, and for the record, there were no PMs in my inbox (for the best no doubt, it's almost full).



Being back at work this week, there's a lot less time to tinker... But today, without the GTF firmware file, I can say - all the IPC does is pass through 4 extra signals from HS CAN to MS CAN for the ICC to listen to. The details are in the picture.

I mean, how hard could it be to just edit that "Signal Configuration" to pass through 4 extra signals unmolested? Yeah, working on it... Damn firmware has hard coded address locations in that signal config - so whatever needs to be added can't change any other data's position... SOB.

[jakka351]

0x397 new can id to me. I am still chasing the mk1 boot images. As I don't really understand what I'm looking for I'm going back to square one.

Starting here:
https://en.m.wikipedia.org/wiki/V850

[JasonACT]

I'm pretty sure I passed the Mk1 boot image details on to a mutual friend, but I decided not to progress anything on that because the ELM327 clone(s) wasn't really up to the task. I know you don't have to use those devices though - so ask around what's the missing bit(s) I guess... I was able to get the full Mk1 firmware (initial boot loader, firmware and RAM snapshot - more than I got with the Mk2).

[jakka351]

And the search for the meaning of this:

candump
enabling Logfile 'candump-0000-00-00_000000.log'
can0 RX - - 1D7 [7] remote request


cansniffer
93|ms | -- ID -- | data ... < can0 # l=20 h=100 t=0 slots=2 >
99999 | ---- 1D7 | FE 9D DF E6 63 F4 B6 ....c..
99999 | 0F745770 | 6B FB 3E B9 B9 DA DD DE k.>.....

[This is a socketcan read of the instrument cluster mk1 powering up in isolation of other modules. It was on the HS bus, not the MS]

[JasonACT]

While we wait for someone with a GTF Instrument Cluster who's willing to extract the special firmware... @Jakka - these are the "decoded" IDs that a Mk1 Cluster handles (reading the V850 document, the hardware register that deals with these is shifted 2 bits, and to be efficient, the programmers left the data that way - so you need to divide by 4 to work out the values):



1D7 does not appear there - I reckon it's a bogus signal when the chip is first configured, especially because it's only 7 bytes, and these things are configured to always generate 8 byte messages. Sorry mate.

[jakka351]

Originally Posted by JasonACT

While we wait for someone with a GTF Instrument Cluster who's willing to extract the special firmware... @Jakka - these are the "decoded" IDs that a Mk1 Cluster handles (reading the V850 document, the hardware register that deals with these is shifted 2 bits, and to be efficient, the programmers left the data that way - so you need to divide by 4 to work out the values):

image

1D7 does not appear there - I reckon it's a bogus signal when the chip is first configured, especially because it's only 7 bytes, and these things are configured to always generate 8 byte messages. Sorry mate.

Hmmmm, I have the same remote frame request from the FDIM in the same conditions. That is also a V850 too. Maybe is just how socketcan reacts