I kindly ask the sponsors whose object of activity is chip-tuning (bell-auto-services, Strathearn Engineering, etc) if there is any command that could be sent to the car for finding in a quick manner all controllers and their CAN ID, in order to know what to scan.

VAG cars has something like that, Gateway Installation List.
http://www.ross-tech.com/vcds/tour/autoscan.html#gateway

Does Ford based car have something like this?

Thank you very much!

Hi Alex....interesting post.I would be interested in this as well.In our cars the CJB acts as a gateway so there should be a list of installed controllers somewhere (just a thought).

I believe the VAG diagnostic system is one of the best among other car manufacturers and combined with VCDS scan tool gives you almost OEM diagnostic capabilities for a price of chinese generic OBD scan tool

I only wish something similar would be available for LRs

Michal

Below are all the NODE ID's, What tool are you going to use ?

HS CAN
Instrument pack Inst Pack 720
Engine management Engine Mgt 7E0
ABS ABS/ ETC 760
ATCM Terrain Resp 792
CJB Body Control 726
HCM Light Control 734
OCS Occupant Sens 765
RCM Airbag 737
RDCM Rear Diff 795
SASM Stg Angle Sens 797
TCM Transfer Box 7E1


MS CAN
AHCM FBH Heater 7E3
DDM Drivers Door 740
DSM Drivers Seat 744
HVAC Hevac 733
ICM Infotainment 784
IPC Instrument pack 720
PAM Park Aid 736
PDM Passenger Door 741
TRM Trailer 791

Thank you very much for the list!

I've home made my own tool - an ARM7 microcontroller (NXP LPC2119) with 2 built in CAN interfaces - this way you can work with both HS and MS channels - linked to the PC through the serial port.

I've already deduced the IDs from IDS's flash VBF files and listening/spying to a diagnostic session, but I was looking for a quick and easy way to read all and active/existent IDs from a car specific configuration, in order to not scan for the non present ones anymore. For example not all cars have FFBH or occupant sensor (NA only) or trailer or etc...
And if I will want to use the tool on other cars than FL2, it will be easier to know dynamically which CAN IDs are available.

Anyway, thank you again for you support!

PS:
On Freelander 2, the instrument pack is only accessible on the MS CAN. On your list appears on both lists.

PS2:
I've seen a scanning tool that is trying to use extended IDs (29 bits) for the following modules.
1BF78D86 Audio Amp
1BF78D80 Audio Control
1BF78D85 DAB Radio
1BF78D8D HD Radio
1BF78D68 Sat Nav
1BF78D81 Sat Radio
1BF78D90 Telephone
1BF78D6E Touch Screen
For example, I have telephone equipment and also Audio Amp and they are not accessible at those IDs.
Do you have any idea why?
Or they will report any trouble codes through the 784 node?

The ID's I posted above are 11 bit.

29bit ID's are here below.


HS
All terrain Terrain Resp 1C
Cruise control ACC Cruise 15
Instrument pack Inst Pack 60
Park brake Park Brake 2A
eng management Engine Mgt 10
airbag Airbag 58
rear diff Rear Diff 1A
eas Air Suspension 2B
steering angle Stg Angle Sens 32
transfer case Transfer Box 19
transmission Auto Gearbox 18
ABS ABS / ETC 20
Front light AFS Head Light 70
ARCM Ride Control 2C
OCS Occupant Sens 5A
MS
head unit Audio Head 80
fbh FBH Heater 0F
CJB Body Control 52
HEVAC Hevac 98
PDC Park Aid B2
TPM Tyre Pressure DA
RDUM Dock Module 6D
VIM Immobilizer C0
DCSM Seat Hevac 9C
RBM Elec Side Step BA
RHVAC Rear Hevac 99
Gateway Gateway D8

MOST
Audio amplifier Audio Amp 86
Digital audio control module C HD Radio 8D
touch screen Touch Screen 61
rem Rear AV 8B
sattelite Sat Radio 81
telephone Telephone 90
Traffic Message TMC 67
TV Television 87
CDP CD Player 82

Thanks again!

But putting side by side your 29 bits list with the one that I've write above, should I understand that to the numbers you wrote an 1BF78D00 should be added?
Because, for example, "Instrument pack Inst Pack 60" - that 60 doesn't look at all like a 29 bit ID.
And in a way it fits:
You said: "Audio amplifier Audio Amp 86", in my list "1BF78D86 Audio Amp"
You said: "sattelite Sat Radio 81", in my list "1BF78D81 Sat Radio"
....
....
What is this 1BF78Dxx ?? A base address?

Should I understand that, for example, the instrument cluster responds at both 11 bits and 29 bits addresses,
eg: 720 and 1BF78D60 (or simply 60 ??) ?

Sorry for such, maybe, stupid questions, but only since several days I've entered on this ground and these are newbie questions...

Hi
Id really rarther and polistly not get to involved here to be honest as it can get very complex as ou are aware and i cant support another diagnostic project. I simplr have to much going on my self.


The 1BF78D00 looks to be in the 29bit range as the range diangposticlly starts 18000000 to 1BFFFFFF without sit working out what it is you have im not sure from memory.


Pete

OK. Thank you very much!
I will keep posted what I'll do...

Please do let me know how you get on, sorry i cant help much more I just have that much going on I really dont want to get distracted from it.

To address the PCM on 11bit you would use a message ID 07E0 8 then your 8 bytes after. and if the Ipac 720 on the end. The 29bit is much the same with the different start as you see and the node ID changing depending on what you are addressing.

You should find that a car is only 11bit or only 29bit and the stuff you see from another tool may actually be a mistake in its programming though its hard to say without knowing all the info you have ?

Pete

I know the basics of the communications.
With the same device I made, I've spied on the bus and I know, for example, that the command for asking trouble codes is: 03 19 02 AF
03 - packet len
19 - ??? probably a mode, just like Ford extended mode 22 from SAE J2190. But 19 isn't documented on J2190.
02 AF - ??? probably the extended PID/command

And the car could respond like: 07 59 02 7F 60 02 62 28
07 - packet len
59 - mode + 40
02 7F - here I didn't understand why the car didn't answered like asked 02 AF ????
60 02 62 28 - error Chassis 2002-62-28

For erasing trouble codes, 04 14 FF FF FF - here extended mode 14, just like in SAE J2190, probably FF FF FF is given with all the bits set in order to erase ALL trouble codes of all types.

Question is where I can find documented all the commands / PIDs / etc with their meaning??

Thanks again!

I have not ever found anything documented on the commands or PIDs used, it seems a close circlewith the manafacturers

Anyhow, thanks a lot for sharing the info.
I saw on the sister forums that you, besides other tuners, are willing to share info. Praise on you for that!
I know that you said that you don't want to get too involved, but in the future if I'll have something to say, can I use your email from your profile to talk?
Thanks!

Your welcome, yes use my email no problem.

pete

A small outcome: http://www.freel2.com/forum/post190042.html#190042

bell-auto-services wrote:

I have not ever found anything documented on the commands or PIDs used, it seems a close circlewith the manafacturers

Yupee... I've found them!

For example, as above:
Request: 03 19 02 AF
03 - packet len
19 - service ID
02 - sub-function, in this case reportDTCByStatusMask
AF - DTCStatusMask

Response: 07 59 02 7F 60 02 62 28
07 - packet len
59 - service ID + 40
02 - sub-function, in this case reportDTCByStatusMask
7F - DTCStatusAvailabilityMask, so here the car reports to which types of errors is able to respond
60 02 62 28 - error Chassis 2002-62-28