• Register Today It's free! This box and some ads will disappear once registered!

^^Searches ExplorerForum.com^^

Running KOEO, KOER using a generic scantool (ELM327)


cristian_vidu

New Member
Joined
February 13, 2007
Messages
15
Reaction score
0
City, State
Bucharest
Year, Model & Trim Level
'97 Explorer 4.0 SOHC
Hi,

Does anyone know how to enter KOEO, KOER and acces all Continuous Memory DTCs using ELM327?

In the PC/ED manual it says to do the following:

- for the KOEO test:

Enter the following string to initiate KOEO Self-Test:
Enter the four strings separately and in the order shown.
All string ID numbers (first field) must match the order shown.
04,3E,22,C4103381,,9E00445443287329208042208062208082A851FF,2F
03,32,22FF,C410220202,,9E00434E54208061A9610004,EA
02,32,22,C410328100,,9E0057414954208081A1816103,5F
01,32,22,C4103181,,9E005354415254208081A1810002,54

- for the KOER test:

Enter the following string to initiate KOER Self-Test:
Enter the four strings separately and in the order shown.
All string ID numbers (first field) must match the order shown.
After the test begins, cycle BOO, 4X4L, PSP and Transmission Control switches (if equipped).
08,3E,22,C4103382,,9E00445443287329208042208062208082A851FF,34
07,32,22FF,C410220202,,9E00434E54208061A9610008,F2
06,32,22,C410328200,,9E0057414954208081A1816107,68
05,32,22,C4103182,,9E005354415254208081A1810006,5D

- to acces ALL the continuous memory DTC's:

Enter the following string to retrieve all Continuous DTCs:
09,2A,21,C41013,,9E00445443287329208B44,6F

Well on my 1997 SOHC Explorer it doesn't work. Actually I did not try the KOEO test because of the 04 in the first line. To me that looks like a mode 4 request and I do not want to reset the PCM at this time.

But the others do not work also. I have tried all the combinations I could think of to retrieve all Continuous DTC, but to no avail. I got either 7F or no data back from the PCM.

I am able to read MIL related DTC though (mode 3). I am also able to access FORD enhanced PID's like transmission fluid temperature, fuel level, etc so it must me something that I doing wrong.

If someone has managed to do this or has any idea please help me out.

Thanks
 


Join the Elite Explorers for $20 per year. Gets rid of the ads! New $5 per month option.

Explorer Forum has probably saved you that much already, and will continue to save you money as you learn how to diagnose fix problems yourself and learn which modifications work without having to experiment on your own. Elite Explorer members see no advertisements, no banner ads, no double underlined links, can add their own profile photo, upload photo attachments in all forums, and Media Gallery, create and save more private Conversations, and more. Join Today. Your support is greatly appreciated.




Turdle

Habla tortuga
Staff member
Moderator
Elite Explorer
Joined
June 16, 2003
Messages
29,472
Reaction score
1,013
City, State
Humboldt, KS
Year, Model & Trim Level
2000 Mounty
I am using a borrowed Elmscan module--however I use the freeware at

www.scantool.net

School me please?
 




cristian_vidu

New Member
Joined
February 13, 2007
Messages
15
Reaction score
0
City, State
Bucharest
Year, Model & Trim Level
'97 Explorer 4.0 SOHC
I am using a borrowed Elmscan module--however I use the freeware at

www.scantool.net

School me please?
I guess you are talking about the ford enhanced PID's because I can't acces the test that I wrote about.

Ok, to access these PID's you can't use the scantool.net program. It doesn't have support for Ford PID's. As far as I know none of the programs that were wrote for the ELM interface support these enhanced PID's.

Use this link to set-up your hyperterminal http://www.scantool.net/support/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=25&nav=0

After you establish communication with the vehicle type this (case doesn't matter):

ATZ
ATSH C410F1

Now you can request any FORD Specific PID using mode 22. For example:

FLI V - fuel level indicator input (volts) PID#16BF

type

2216BF

You should get a reply from the car with the voltage output from the sensor. the reply should look something like 6216bfxxxx where xxxx is the encoded voltage. You should multiply the decimal equivalent with 0.031 to get the actual value.

To be honest I am having trouble with the conversion myself so I will study the standard because I am getting some strange values when I convert.

Another example

GEAR - Transmission Gear Status PID#11B3

2211B3

The reply is something like 6211B30002 if I remember corectly. Well in my car that means I am in 1st gear. The way I decode it 0004 means 2nd gear, strangely 0006 means 3rd gear, 0008 means 4th gear and I didn't get the chance to drive it at more than 90kmph to see how 5th gear looks like.

If you need any more info please reply.

EDIT: The rest of the enhanced PID's can be found in the PC/ED manual for your vehicle. If you need to I can try to post them here.
 
Last edited:








Lukeyson

New Member
Joined
May 23, 2007
Messages
4
Reaction score
0
City, State
Maitland
Year, Model & Trim Level
2003
Wow. OK, trying to make sense of that first post.

I'm going to ignore the first byte because it looks sequential.

Which byte is the mode though is confusing. I see a lot of 22's in there, and most custom PIDS can be extract using mode 22. But I've generally used mode 2F to activate diags by PID. (I have a 2003 Australian Ford BA Falcon - which has a 5.4L Modular V8, so I mustn't be too far removed from an Explorer....!)

So if the 2nd byte is the mode, then I'm looking at modes 3E, 32 and 2A.

J2190 doesn't have 3E

32 however is much list 2F in that it triggers a diag, but does it via the diag 'number' rather than a PID.

And 2A is a 'Request Diagnostic Packet'.

So some of it at least makes sense. When I have more time I'll see what the other parts of the lines tell me.

But I would be interested in any of the Ford Custom PIDS if you have a mapping of PID String to PID Hex Value and any scaling factors. That stuff is very hard to find....


Lukeyson
 




cristian_vidu

New Member
Joined
February 13, 2007
Messages
15
Reaction score
0
City, State
Bucharest
Year, Model & Trim Level
'97 Explorer 4.0 SOHC
But I would be interested in any of the Ford Custom PIDS if you have a mapping of PID String to PID Hex Value and any scaling factors. That stuff is very hard to find....


Lukeyson
You can find this information in the Service Manual. The Service Manuals can be found here http://www.fordcds.com. They are kind of big but they do contain the information that you need.

I copy&pasted just the information that you need in a PDF but i can't find any way to attach it to this post. So if you would like send me a PM with your email address and I'll send you this PDF.

In case you have any success with the KOEO(R) tests please enlighten me also.

Thanks.

Cristian
 




Lukeyson

New Member
Joined
May 23, 2007
Messages
4
Reaction score
0
City, State
Maitland
Year, Model & Trim Level
2003
OK, it's starting to make sense.

When forming CAN packets, there's a lot of information that has to go into making up all the information needed. The ELM327, however, does all that for you. And it does HEAPS fo stuff, like waking the bus up for you, keeping it awake, and generating pretty much ALL of the information you need to send a message quickly and simply.

What I see there is a packet with a bunch of leading information (3 bytes) then a CAN header with a PID, then a whole bunch of stuff at the end - probably to do with the CRC.

So from this line:
08,3E,22,C4103382,,9E00445443287329208042208062208082A851FF,34

The only bit I see that's interesting is: C4103382. This looks to consist of a 3-byte header and a Mode/PID.

So on an elm327 you would set the header with:
atshc41033

The header has information that includes the source address and destination address and is much like a normal packet header. This could be a physical or functional address (ie a specific module or a 'group' of modules). I am used to see Scantool-to-PCM addresses appear as C410F1. So it's scantool to something in this case (33).

Then issue the Mode request with no PID
82

In other examples, Mode 22 is a 'request information by PID' mode (according to J2190) so 22114D would be the query for Engine Coolant temperature in Volts.

Now this is early day stuff for me. My Modular V8 has an 11-bit CAN Bus based PCM, so I only issue 1.5byte heahder messages (like atsh3e7 - which are functional addresses only). And mode 82 is up there in the 'vendor specific stuff' so whether this works or not is another story. But I can issue mode 22 requests with the best of them.

But that's how I see it at the moment. Cristian has given me some added information that REALLY helps, so as soon as I get more time to look at in detail I will.


Lukeyson
 




Lukeyson

New Member
Joined
May 23, 2007
Messages
4
Reaction score
0
City, State
Maitland
Year, Model & Trim Level
2003
So on an ELM327


Plug it in to OBD2 port and PC and fire up Hyperterminal and 9600 or 38400bps (depending on the dip-switch setting on the ELM327 unit)

The issue:

ATZ

The unit should have picked your main protocol. If not look up the ELM327 guide to find out how to select your protocol.

If you want to see the full message in any reply, turn on response headers - ath1. if not, ath0 is the default, and you can reset it that way by type ath0 of course.

Then set the header for the first packet:
atshc41033

Then issue query or cmomand
81

Then set header for next query
atshc41022

Then ext message is
0202 -> Which is a freeze frame data query from J1979?

atshc41032
8100
atshc41031
81



Lukeyson
 




dcorwin822

New Member
Joined
June 3, 2007
Messages
30
Reaction score
0
anyone have any updates on this? im very interested in getting my elm327 to support those tests!
 




Lukeyson

New Member
Joined
May 23, 2007
Messages
4
Reaction score
0
City, State
Maitland
Year, Model & Trim Level
2003
Have you tried what I wrote?

I have a CAN based Ford so can't do it for you.


Lukeyson
 




cristian_vidu

New Member
Joined
February 13, 2007
Messages
15
Reaction score
0
City, State
Bucharest
Year, Model & Trim Level
'97 Explorer 4.0 SOHC
Sorry for the late reply.

Yep, I have tried everything and it doesn't work. I've tried all possible combinations and all I get is 7F. I'll post back later a transcript of the dialogue with the car.

One curious thing that I saw was that the reply from the car changes in some cases if you turn headers on (ATH1). One example is fuel trim and O2 sensors. In my Explorer all applications read these as 0. If I go in hyperterminal with headers off I get 0, but when I turn headers on I get a non zero response. I did not convert it so I have no idea if the answer is plausible or not but at least is not 0.
Edit: My mistake, sorry. I was looking at the last byte and when I change to ATH1 that is the CRC (or something similar).

I'll keep trying.

Here is another site I have found and maybe it will help you with the decoding of your vehicle: http://obddiagnostics.com/obdinfo/info.html

Edit:

Here is a copy of the dialogue with the car:

>atshc41033
OK

>81
7F 81 00 00 00 11

>atshc41022

OK

>0202
7F 02 02 00 00 11

>atshc41032
OK

>8100
7F 81 00 00 00 11

>atshc41031
OK

>81
7F 81 00 00 00 11

>07
7F 07 00 00 00 11

>atz

ELM327 v1.1

>0101
41 01 81 07 E0 00

>011c
41 1C 04

>ath0
OK

>0101
41 01 81 07 E0 00

>ath1
OK

>0101
41 6B 10 41 01 81 07 E0 00 82

>010c
41 6B 10 41 0C 00 00 DC

>atshc410f1
OK

>221101
C4 F1 10 62 11 01 00 5A

>atsh41106b
OK

>010c
NO DATA

>010c
NO DAT
C4 F1 10 62 11 01 00 5A

>atz


ELM327 v1.1

>ath1
OK

>010c
41 6B 10 41 0C 00 00 DC

>0114
41 6B 10 41 14 00 00 C8

>0115
41 6B 10 41 15 00 00 47

>atz


ELM327 v1.1

>0114
41 14 00 00

>0115
41 15 00 00

>ath1
OK

>0114
41 6B 10 41 14 00 00 C8

>ath0
OK

>0115
41 15 00 00

>0114
41 14 00 00

>ath1
OK

>0114
41 6B 10 41 14 00 00 C8

>0107
41 6B 10 41 07 00 44

>0109
41 6B 10 41 09 00 AB

>0118
41 6B 10 41 18 00 00 C2

>0119
41 6B 10 41 19 00 00 4D

>0119
41 6B 10 41 19 00 00 4D
 
Last edited:




dcorwin822

New Member
Joined
June 3, 2007
Messages
30
Reaction score
0
do they make a device that can intercept data packets or just log data packets being sent between the elm and ecm? if so instead of the ELM use the ford tool and see what its actually sending out.... i really wonder if they make such a device....

EDIT:

I answered my own question... the ELM can monitor the bus.... go to page 30 of this PDF: http://www.elmelectronics.com/DSheets/ELM327DS.pdf and read.... now someone that has the ability to do the KOER KOEO tests and that also has a ELM327 needs to set there ELM in this monitor mode and than monitor the commands being sent from the ford tool.... sounds crazy but i think it might work? who knows... i dont have a ford tool nor a obd2 splitter
 
Last edited:








cristian_vidu

New Member
Joined
February 13, 2007
Messages
15
Reaction score
0
City, State
Bucharest
Year, Model & Trim Level
'97 Explorer 4.0 SOHC
Monitoring the bus

Hello dcorwin,

Yep, I have seen your post. Unfortunatelly I do not have access to an NGS to do the tests. But your idea of monitoring the bus sounds nice. As soon as I'll have some free time I'll give it a go.

I have just managed to get a hold of J2178 and I am now reading it to see if I can make any sense of those strings.

Cristian
 












cherrybomb

Active Member
Joined
April 1, 2005
Messages
259
Reaction score
0
City, State
Southern California
Year, Model & Trim Level
'99 EB 5.0L (R.I.P)
EDIT: The rest of the enhanced PID's can be found in the PC/ED manual for your vehicle. If you need to I can try to post them here.
Where, exactly, in the manual do I find that information? I have the service manual CD, and all I ever see listed are the PID's by name, but not their numeric value as you show in your post. I.E. #xxxx in hex.
 

Attachments









cristian_vidu

New Member
Joined
February 13, 2007
Messages
15
Reaction score
0
City, State
Bucharest
Year, Model & Trim Level
'97 Explorer 4.0 SOHC
PIDs

Here is how I got to them:

1996-1999 Ford Service Manual DVD/96_99.iso






Up until now I didn't have the time to work some more on this as just last night a fuse refused to blow and decided it liked better to melt (along with some wires inside the dash) and now my car is more or less grounded.

So, if any of you has some luck with these tests please share.
 
Last edited:


Join the Elite Explorers for $20 per year. Gets rid of the ads! New $5 per month option.

Explorer Forum has probably saved you that much already, and will continue to save you money as you learn how to diagnose fix problems yourself and learn which modifications work without having to experiment on your own. Elite Explorer members see no advertisements, no banner ads, no double underlined links, can add their own profile photo, upload photo attachments in all forums, and Media Gallery, create and save more private Conversations, and more. Join Today. Your support is greatly appreciated.




cherrybomb

Active Member
Joined
April 1, 2005
Messages
259
Reaction score
0
City, State
Southern California
Year, Model & Trim Level
'99 EB 5.0L (R.I.P)
Here is how I got to them:

1996-1999 Ford Service Manual DVD/96_99.iso
Thanks cristian!

Evidently, you have a different service manual CD/DVD than I do. Where did you get yours?

Mine seems to be perhaps older, and specific to a few models.
 




Thread starter Similar threads Forum Replies Date
S Running laptop ELM and OBD 2007 failed 2 test? EEC V 2
J engine running rough EEC V 2
L Running rough so I'm chasing OBD codes but getting lost EEC V 11
Top