Running KOEO, KOER using a generic scantool (ELM327) | Ford Explorer Forums - Serious Explorations

  • Register Today It's free!

Running KOEO, KOER using a generic scantool (ELM327)

cristian_vidu

Member
Joined
February 13, 2007
Messages
15
Reaction score
0
City, State
Bucharest
Year, Model & Trim Level
'97 Explorer 4.0 SOHC
Hi,

Does anyone know how to enter KOEO, KOER and acces all Continuous Memory DTCs using ELM327?

In the PC/ED manual it says to do the following:

- for the KOEO test:

Enter the following string to initiate KOEO Self-Test:
Enter the four strings separately and in the order shown.
All string ID numbers (first field) must match the order shown.
04,3E,22,C4103381,,9E00445443287329208042208062208082A851FF,2F
03,32,22FF,C410220202,,9E00434E54208061A9610004,EA
02,32,22,C410328100,,9E0057414954208081A1816103,5F
01,32,22,C4103181,,9E005354415254208081A1810002,54

- for the KOER test:

Enter the following string to initiate KOER Self-Test:
Enter the four strings separately and in the order shown.
All string ID numbers (first field) must match the order shown.
After the test begins, cycle BOO, 4X4L, PSP and Transmission Control switches (if equipped).
08,3E,22,C4103382,,9E00445443287329208042208062208082A851FF,34
07,32,22FF,C410220202,,9E00434E54208061A9610008,F2
06,32,22,C410328200,,9E0057414954208081A1816107,68
05,32,22,C4103182,,9E005354415254208081A1810006,5D

- to acces ALL the continuous memory DTC's:

Enter the following string to retrieve all Continuous DTCs:
09,2A,21,C41013,,9E00445443287329208B44,6F

Well on my 1997 SOHC Explorer it doesn't work. Actually I did not try the KOEO test because of the 04 in the first line. To me that looks like a mode 4 request and I do not want to reset the PCM at this time.

But the others do not work also. I have tried all the combinations I could think of to retrieve all Continuous DTC, but to no avail. I got either 7F or no data back from the PCM.

I am able to read MIL related DTC though (mode 3). I am also able to access FORD enhanced PID's like transmission fluid temperature, fuel level, etc so it must me something that I doing wrong.

If someone has managed to do this or has any idea please help me out.

Thanks
 



Join the Elite Explorers for $20 each year.
Elite Explorer members see no advertisements, no banner ads, no double underlined links,.
Add an avatar, upload photo attachments, and more!
.











I am using a borrowed Elmscan module--however I use the freeware at

www.scantool.net

School me please?

I guess you are talking about the ford enhanced PID's because I can't acces the test that I wrote about.

Ok, to access these PID's you can't use the scantool.net program. It doesn't have support for Ford PID's. As far as I know none of the programs that were wrote for the ELM interface support these enhanced PID's.

Use this link to set-up your hyperterminal http://www.scantool.net/support/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=25&nav=0

After you establish communication with the vehicle type this (case doesn't matter):

ATZ
ATSH C410F1

Now you can request any FORD Specific PID using mode 22. For example:

FLI V - fuel level indicator input (volts) PID#16BF

type

2216BF

You should get a reply from the car with the voltage output from the sensor. the reply should look something like 6216bfxxxx where xxxx is the encoded voltage. You should multiply the decimal equivalent with 0.031 to get the actual value.

To be honest I am having trouble with the conversion myself so I will study the standard because I am getting some strange values when I convert.

Another example

GEAR - Transmission Gear Status PID#11B3

2211B3

The reply is something like 6211B30002 if I remember corectly. Well in my car that means I am in 1st gear. The way I decode it 0004 means 2nd gear, strangely 0006 means 3rd gear, 0008 means 4th gear and I didn't get the chance to drive it at more than 90kmph to see how 5th gear looks like.

If you need any more info please reply.

EDIT: The rest of the enhanced PID's can be found in the PC/ED manual for your vehicle. If you need to I can try to post them here.
 












Wow. OK, trying to make sense of that first post.

I'm going to ignore the first byte because it looks sequential.

Which byte is the mode though is confusing. I see a lot of 22's in there, and most custom PIDS can be extract using mode 22. But I've generally used mode 2F to activate diags by PID. (I have a 2003 Australian Ford BA Falcon - which has a 5.4L Modular V8, so I mustn't be too far removed from an Explorer....!)

So if the 2nd byte is the mode, then I'm looking at modes 3E, 32 and 2A.

J2190 doesn't have 3E

32 however is much list 2F in that it triggers a diag, but does it via the diag 'number' rather than a PID.

And 2A is a 'Request Diagnostic Packet'.

So some of it at least makes sense. When I have more time I'll see what the other parts of the lines tell me.

But I would be interested in any of the Ford Custom PIDS if you have a mapping of PID String to PID Hex Value and any scaling factors. That stuff is very hard to find....


Lukeyson
 






But I would be interested in any of the Ford Custom PIDS if you have a mapping of PID String to PID Hex Value and any scaling factors. That stuff is very hard to find....


Lukeyson

You can find this information in the Service Manual. The Service Manuals can be found here http://www.fordcds.com. They are kind of big but they do contain the information that you need.

I copy&pasted just the information that you need in a PDF but i can't find any way to attach it to this post. So if you would like send me a PM with your email address and I'll send you this PDF.

In case you have any success with the KOEO(R) tests please enlighten me also.

Thanks.

Cristian
 






OK, it's starting to make sense.

When forming CAN packets, there's a lot of information that has to go into making up all the information needed. The ELM327, however, does all that for you. And it does HEAPS fo stuff, like waking the bus up for you, keeping it awake, and generating pretty much ALL of the information you need to send a message quickly and simply.

What I see there is a packet with a bunch of leading information (3 bytes) then a CAN header with a PID, then a whole bunch of stuff at the end - probably to do with the CRC.

So from this line:
08,3E,22,C4103382,,9E00445443287329208042208062208082A851FF,34

The only bit I see that's interesting is: C4103382. This looks to consist of a 3-byte header and a Mode/PID.

So on an elm327 you would set the header with:
atshc41033

The header has information that includes the source address and destination address and is much like a normal packet header. This could be a physical or functional address (ie a specific module or a 'group' of modules). I am used to see Scantool-to-PCM addresses appear as C410F1. So it's scantool to something in this case (33).

Then issue the Mode request with no PID
82

In other examples, Mode 22 is a 'request information by PID' mode (according to J2190) so 22114D would be the query for Engine Coolant temperature in Volts.

Now this is early day stuff for me. My Modular V8 has an 11-bit CAN Bus based PCM, so I only issue 1.5byte heahder messages (like atsh3e7 - which are functional addresses only). And mode 82 is up there in the 'vendor specific stuff' so whether this works or not is another story. But I can issue mode 22 requests with the best of them.

But that's how I see it at the moment. Cristian has given me some added information that REALLY helps, so as soon as I get more time to look at in detail I will.


Lukeyson
 






So on an ELM327


Plug it in to OBD2 port and PC and fire up Hyperterminal and 9600 or 38400bps (depending on the dip-switch setting on the ELM327 unit)

The issue:

ATZ

The unit should have picked your main protocol. If not look up the ELM327 guide to find out how to select your protocol.

If you want to see the full message in any reply, turn on response headers - ath1. if not, ath0 is the default, and you can reset it that way by type ath0 of course.

Then set the header for the first packet:
atshc41033

Then issue query or cmomand
81

Then set header for next query
atshc41022

Then ext message is
0202 -> Which is a freeze frame data query from J1979?

atshc41032
8100
atshc41031
81



Lukeyson
 






anyone have any updates on this? im very interested in getting my elm327 to support those tests!
 






Have you tried what I wrote?

I have a CAN based Ford so can't do it for you.


Lukeyson
 






Sorry for the late reply.

Yep, I have tried everything and it doesn't work. I've tried all possible combinations and all I get is 7F. I'll post back later a transcript of the dialogue with the car.

One curious thing that I saw was that the reply from the car changes in some cases if you turn headers on (ATH1). One example is fuel trim and O2 sensors. In my Explorer all applications read these as 0. If I go in hyperterminal with headers off I get 0, but when I turn headers on I get a non zero response. I did not convert it so I have no idea if the answer is plausible or not but at least is not 0.
Edit: My mistake, sorry. I was looking at the last byte and when I change to ATH1 that is the CRC (or something similar).

I'll keep trying.

Here is another site I have found and maybe it will help you with the decoding of your vehicle: http://obddiagnostics.com/obdinfo/info.html

Edit:

Here is a copy of the dialogue with the car:

>atshc41033
OK

>81
7F 81 00 00 00 11

>atshc41022

OK

>0202
7F 02 02 00 00 11

>atshc41032
OK

>8100
7F 81 00 00 00 11

>atshc41031
OK

>81
7F 81 00 00 00 11

>07
7F 07 00 00 00 11

>atz

ELM327 v1.1

>0101
41 01 81 07 E0 00

>011c
41 1C 04

>ath0
OK

>0101
41 01 81 07 E0 00

>ath1
OK

>0101
41 6B 10 41 01 81 07 E0 00 82

>010c
41 6B 10 41 0C 00 00 DC

>atshc410f1
OK

>221101
C4 F1 10 62 11 01 00 5A

>atsh41106b
OK

>010c
NO DATA

>010c
NO DAT
C4 F1 10 62 11 01 00 5A

>atz


ELM327 v1.1

>ath1
OK

>010c
41 6B 10 41 0C 00 00 DC

>0114
41 6B 10 41 14 00 00 C8

>0115
41 6B 10 41 15 00 00 47

>atz


ELM327 v1.1

>0114
41 14 00 00

>0115
41 15 00 00

>ath1
OK

>0114
41 6B 10 41 14 00 00 C8

>ath0
OK

>0115
41 15 00 00

>0114
41 14 00 00

>ath1
OK

>0114
41 6B 10 41 14 00 00 C8

>0107
41 6B 10 41 07 00 44

>0109
41 6B 10 41 09 00 AB

>0118
41 6B 10 41 18 00 00 C2

>0119
41 6B 10 41 19 00 00 4D

>0119
41 6B 10 41 19 00 00 4D
 






do they make a device that can intercept data packets or just log data packets being sent between the elm and ecm? if so instead of the ELM use the ford tool and see what its actually sending out.... i really wonder if they make such a device....

EDIT:

I answered my own question... the ELM can monitor the bus.... go to page 30 of this PDF: http://www.elmelectronics.com/DSheets/ELM327DS.pdf and read.... now someone that has the ability to do the KOER KOEO tests and that also has a ELM327 needs to set there ELM in this monitor mode and than monitor the commands being sent from the ford tool.... sounds crazy but i think it might work? who knows... i dont have a ford tool nor a obd2 splitter
 












Monitoring the bus

Hello dcorwin,

Yep, I have seen your post. Unfortunatelly I do not have access to an NGS to do the tests. But your idea of monitoring the bus sounds nice. As soon as I'll have some free time I'll give it a go.

I have just managed to get a hold of J2178 and I am now reading it to see if I can make any sense of those strings.

Cristian
 


















EDIT: The rest of the enhanced PID's can be found in the PC/ED manual for your vehicle. If you need to I can try to post them here.

Where, exactly, in the manual do I find that information? I have the service manual CD, and all I ever see listed are the PID's by name, but not their numeric value as you show in your post. I.E. #xxxx in hex.
 

Attachments

  • pcedmenu.jpg
    pcedmenu.jpg
    51.5 KB · Views: 6,374












PIDs

Here is how I got to them:

1996-1999 Ford Service Manual DVD/96_99.iso


explorer_pid_1.jpg


explorer_pid_2.jpg


Up until now I didn't have the time to work some more on this as just last night a fuse refused to blow and decided it liked better to melt (along with some wires inside the dash) and now my car is more or less grounded.

So, if any of you has some luck with these tests please share.
 



Join the Elite Explorers for $20 each year.
Elite Explorer members see no advertisements, no banner ads, no double underlined links,.
Add an avatar, upload photo attachments, and more!
.





Here is how I got to them:

1996-1999 Ford Service Manual DVD/96_99.iso

Thanks cristian!

Evidently, you have a different service manual CD/DVD than I do. Where did you get yours?

Mine seems to be perhaps older, and specific to a few models.
 






Back
Top