So this is going to be a long post, but stick with me here. One of my projects is to use Ford's MyFord Touch SYNC system in a stand-alone application (i.e. - my 2003 F-250). This system, in it's most minimalist form requires four modules (nodes) to operate.
Accessory Protocol Interface Module (APIM)
Audio Control Module (ACM)
Digital Signal Processor (DSP)
Front Control Interface Module (FCIM)
These modules operate over three different networks;
So the CBT is perfect to run this operation. All four of these modules receive a constant 12 volts and power on from "wake up" packets sent over CAN. My objective is to copy these packets from a vehicle with the same system (in this case a 2012 Ford Focus). Then re-write the CBT firmware to send these packets based on inputs from the CBT analog inputs.
Here's the problem, I made a OBD-II harness to connect the CBT to the three networks in the vehicle. However, as soon as I connect the CBT to the OBD-II port, the vehicle networks all crash. All nodes appear to crash. Basically, the engine goes into whats know as "Limp Home Mode" or "Fail Safe". Basically, it is a limited operating strategy for fault conditions. Also pretty much every light on the dash comes on, every warning message, and the entire vehicle begins to shut down, one module after another. Usually network screw ups like this can be corrected by simply cycling the key, however sometimes even the ignition switch become unresponsive until the battery is disconnected.
I'm not sure where this problem originates. I tossed around the idea of clock synchronization, as well as, possibly the nodes recognizing the CBT as something that is not supposed to be on the network. Honestly, I'm at a loss for explanation. I did connect the CBT to another vehicle (07 F-150 with only HS-CAN) and and monitored packets with no problem. But, I tried it with two different Focus(s), and both times had the same problem. Has anyone else had an issue like this?
Long story short, I'm having problems connecting the CBT to a vehicle (another story for another post). So for now I'm using a ECU simulator with ISO 15765. I Connected a scan tool, and monitored all the packets being broadcast to read live RPM data. After the scan tool asks for supported PIDs, I select RPM, then begin the stream. When I begin the stream, the scan tool sends 0636 02 01 0C 00 00 00 00 00. The response from the ECU is 0636 04 41 0C 5E 55 00 00 00 ("5E 55" being the RPM value). I know that that is the expected response, but it only works when the scan tool sends it. If I send:
0201 0636 02 01 0C 00 00 00 00 00 08 (without spaces) on the CBT serial command, this is the response I get:
0455 A0 00 00 00 00
03E2 00 00 00 00
03DA 1 64 0 0 0 0 0 0
05E2 62 0 FF FF FF FF 0 0
All four packets repeat about 10 times, and I never get an RPM packet. Anybody have any ideas? I might be doing something wrong, but I'm not sure.