Telematics, BMS and their connection.

[pboggini]

Midweek I noticed that my charging voltage was higher than normal. Slightly concerning since I have my SOC set to 100% in Forscan and I have a new Lariat battery that's about 4 months old and I thought "crap, I hope I'm not cooking it." I also noticed that Fordpass wasn't updating since around the same time. Some searching around this site led me to a thread talking about the "telematics" fuse so a couple of nights ago I pulled it out, (fuse 9 BTW under the dash), walked into the garage, pulled out the multimeter and checked continuity and all was good. OK, put it back in, turn the key on and navigate to the menu (note, I'm a rube, I have the base sync stuff which is pretty rudimentary just the way I like it) and it started showing me an LTE and WiFi connection. OK, cool. Check Fordpass and it updates the location, mileage, tire pressure, etc. Nice.

This morning (2 days later), my charging voltage starts returning down back to normal from 14.6 (remember I have a USB charging thing that replaced the old 12V outlet) down to 14.3. Hmm, connection? Maybe. OK, after coffee, it drops down to a more respectable 14.0. I think these things were connected.

My theory, the modem was in a whacked state and was hammering the battery. I guess it's a good thing 1) I have my SOC set to 100%, B) it's a new battery III) I have a desulfator and, finally D) I noticed and rebooting the modem took care of it.

peterb

Sponsored

 

[got3fords]

Midweek I noticed that my charging voltage was higher than normal. Slightly concerning since I have my SOC set to 100% in Forscan and I have a new Lariat battery that's about 4 months old and I thought "crap, I hope I'm not cooking it." I also noticed that Fordpass wasn't updating since around the same time. Some searching around this site led me to a thread talking about the "telematics" fuse so a couple of nights ago I pulled it out, (fuse 9 BTW under the dash), walked into the garage, pulled out the multimeter and checked continuity and all was good. OK, put it back in, turn the key on and navigate to the menu (note, I'm a rube, I have the base sync stuff which is pretty rudimentary just the way I like it) and it started showing me an LTE and WiFi connection. OK, cool. Check Fordpass and it updates the location, mileage, tire pressure, etc. Nice.

This morning (2 days later), my charging voltage starts returning down back to normal from 14.6 (remember I have a USB charging thing that replaced the old 12V outlet) down to 14.3. Hmm, connection? Maybe. OK, after coffee, it drops down to a more respectable 14.0. I think these things were connected.

My theory, the modem was in a whacked state and was hammering the battery. I guess it's a good thing 1) I have my SOC set to 100%, B) it's a new battery III) I have a desulfator and, finally D) I noticed and rebooting the modem took care of it.

peterb

Interesting...Lately my charge voltage is near 15V, but occasionally it will drop down to 13-14V. Seems like it does it more in colder weather. ASS hasn't been working either. (no biggie)

 

[airline tech]

Since we know that the - BMS Recalibration occurs during periods of - Sleep Mode and that the TCU is used to (Update) Health & Location status - and tie this in with what @TJC noted with Dark Current draw.
Then this would indicate a similar issue to (Cell Phone) battery drain when in a Concrete Building with a (Low Signal) trying to connect to WI-FI for a strong signal.
So, the TCU is consistently powering trying to connect to the Ford Servers to update Health & Location
This Constant - Power Draw has the BMS reading this draw, and at start up, sets the charging voltage higher to overcome that overnight drain.
The Deep Sleep - Notification would never be able to (Transmit) as the TCU would not connect to the Servers to send the information.

I was in the middle of a (Test) - I wanted to know on a (Average) how many times in an (12-Hour) period of the truck being shut off. (Did the TCU power up and transmit updated data?)

My test was left unresolved as when - Ford Pass updated we lost the (Last Updated - Time Stamp)
in the Ford Pass App.
There is (NOT) any documentation on how often this occurs and what actually triggers the (Knock-Knock - Hey Ranger, how are you doing?)
And the other question is - Is it the Ford Servers or is it the TCU software that triggers the Initial Knock.
I was curious as to what triggered this event - when in the garage and the (Waste Gate) powers on its own (This is the Wake Circuit) and I believe (Not Confirmed), when the TCU Powers it powers the Wake Circuit via (Can Bus)
So, there are a number of things (Powered) when the Wake Circuit is powered, this is the Current Draw.
The Reasoning - All important modules are powered enough to read any codes, and current status - Odometer Reading, Tire PSI & GPS Location.

The bottom line is - Even if you do not have Ford Pass, the truck is still transmitting data to Ford and all Ford Pass does is allow (You) to see that data and also use the extra features of (Unlock/Lock) Remote Start Etc.

It would be nice if they - Reintroduce the (Last Updated) Time Stamp, where you could swipe down on the location and it would give you (Last Updated) Time, this would be when the TCU last powered up and communicated with the servers.

 

[dtech]

"So, the TCU is consistently powering trying to connect to the Ford Servers to update Health & Location
This Constant - Power Draw has the BMS reading this draw, and at start up, sets the charging voltage higher to overcome that overnight drain. "

Too bad Ford didn't program logic to adjust the SOC algorithm when driving habits result in a consistent SOC condition that is sufficiently low to promote battery failure.

 

[pboggini]

Oh, one other thing, if you have the rudimentary sync setup and you notice a battery icon from your phone and not the location icon then your modem might be struggling. That was one other thing I noticed and after resetting the modem and driving it the next morning the normal location icon returned.

Now I know and can act on it more quickly than 4 days.

peterb

 

[TJC]

Since we know that the - BMS Recalibration occurs during periods of - Sleep Mode and that the TCU is used to (Update) Health & Location status - and tie this in with what @TJC noted with Dark Current draw.
Then this would indicate a similar issue to (Cell Phone) battery drain when in a Concrete Building with a (Low Signal) trying to connect to WI-FI for a strong signal.
So, the TCU is consistently powering trying to connect to the Ford Servers to update Health & Location
This Constant - Power Draw has the BMS reading this draw, and at start up, sets the charging voltage higher to overcome that overnight drain.
The Deep Sleep - Notification would never be able to (Transmit) as the TCU would not connect to the Servers to send the information.

I was in the middle of a (Test) - I wanted to know on a (Average) how many times in an (12-Hour) period of the truck being shut off. (Did the TCU power up and transmit updated data?)

My test was left unresolved as when - Ford Pass updated we lost the (Last Updated - Time Stamp)
in the Ford Pass App.
There is (NOT) any documentation on how often this occurs and what actually triggers the (Knock-Knock - Hey Ranger, how are you doing?)
And the other question is - Is it the Ford Servers or is it the TCU software that triggers the Initial Knock.
I was curious as to what triggered this event - when in the garage and the (Waste Gate) powers on its own (This is the Wake Circuit) and I believe (Not Confirmed), when the TCU Powers it powers the Wake Circuit via (Can Bus)
So, there are a number of things (Powered) when the Wake Circuit is powered, this is the Current Draw.
The Reasoning - All important modules are powered enough to read any codes, and current status - Odometer Reading, Tire PSI & GPS Location.

The bottom line is - Even if you do not have Ford Pass, the truck is still transmitting data to Ford and all Ford Pass does is allow (You) to see that data and also use the extra features of (Unlock/Lock) Remote Start Etc.

It would be nice if they - Reintroduce the (Last Updated) Time Stamp, where you could swipe down on the location and it would give you (Last Updated) Time, this would be when the TCU last powered up and communicated with the servers.

Sound reasoning and very good hypothesis. Unfortunately Ford does not publish handshake sequences and logic progressions. Ford should publish both HW and SW logic progressions. An architectural level view would be sufficient).

If you are interested, you may have better luck looking at Ford documentation published for Australia as they have more liberal right to repair laws. It was the only geography where I could find Mazda CX-5 repair manuals online. I am go to attempt to disable the CX-5 telematics module (cellular modem) today, as I have just completed organizing the steps required to access the modem. It appears to be burried quite a bit deeper than the Ranger. I do not think unplugging the antenna is enough. It will break the connection, but I suspect the modem will keep retrying until it reaches a max number of attempts for the day.

So I'm going to pull the plug on it on the CX-5 and see what errors it throws.

Back to the Ranger. I am highly suspect that leaving the cellular modem connected even with the Forscan entry set to OFF and the Telematics fuse removed, that Ford may still be able to communicate via a backdoor. Best to "air gap" the Ranger and CX-5. Without deeper understanding of the system (which Ford is keeping close to their vest) it is the only way to be sure that Ford doesn't have a backdoor, and that power drain is minimized.

The Ranger threw an error, but I have had no ill affects other than the error showing Telematics offline. I am hoping for the same result for the CX-5.

 

[Frenchy]

So one thing to consider is you have a Variable Voltage System on your truck. It's nothing new as you know. Depending on how the logic is set from Ford(regardless of what you did for changes), it will change the charge Voltage as needed while you are driving down the road. That voltage can vary from 12.6 up to 15 volts without question.

Why would it do that? Because if the battery is charged, you don't need to keep charging it. That simple.

Is it related to the TCU? I don't believe so, but I would have to look at the wiring diagrams to verify.

 

[TJC]

So one thing to consider is you have a Variable Voltage System on your truck. It's nothing new as you know. Depending on how the logic is set from Ford(regardless of what you did for changes), it will change the charge Voltage as needed while you are driving down the road. That voltage can vary from 12.6 up to 15 volts without question.

Why would it do that? Because if the battery is charged, you don't need to keep charging it. That simple.

Is it related to the TCU? I don't believe so, but I would have to look at the wiring diagrams to verify.

I believe that you'll need access to the software logic to gain a clear understanding of the BMS.

BMS is as much or more a function of software (firmware). Modern autos are computer networks on wheels. If you think in terms of computer layers, you got at teh bottom, hardware, multiple layers of Firmware (up to 20 that boot and run before the BIOS routines begin, BIOS, OSes, and finally Apps that run on top of it all.

Each one of those mini computers in our Rangers boot up and interconnect on the network, just like a conventional computer network. Different naming conventions, but same process flow. You can do a LOT of different things with Raspberry Pi hardware, same goes for the BMS harware in the Ranger.

Without being able to see the source code or the SW logic flow diagrams, you are flying blind.

Give a lot of credit to the Forscan team for reverse engineering the Ford Software as far as they have. It is an impressive achievement. When I am working in Forscan I get the same feeling I get when manipulating the Windows Registry, or Linux Config files.

 

[pboggini]

Give a lot of credit to the Forscan team for reverse engineering the Ford Software as far as they have. It is an impressive achievement. When I am working in Forscan I get the same feeling I get when manipulating the Windows Registry, or Linux Config files.

Long time Unix Sys Admin, who's had to deal with Windows. I feel the same way.

peterb

 

[Frenchy]

I believe that you'll need access to the software logic to gain a clear understanding of the BMS.

BMS is as much or more a function of software (firmware). Modern autos are computer networks on wheels. If you think in terms of computer layers, you got at teh bottom, hardware, multiple layers of Firmware (up to 20 that boot and run before the BIOS routines begin, BIOS, OSes, and finally Apps that run on top of it all.

Each one of those mini computers in our Rangers boot up and interconnect on the network, just like a conventional computer network. Different naming conventions, but same process flow. You can do a LOT of different things with Raspberry Pi hardware, same goes for the BMS harware in the Ranger.

Without being able to see the source code or the SW logic flow diagrams, you are flying blind.

Give a lot of credit to the Forscan team for reverse engineering the Ford Software as far as they have. It is an impressive achievement. When I am working in Forscan I get the same feeling I get when manipulating the Windows Registry, or Linux Config files.

The BMS is still nothing too special. For starters it stands for Battery Monitoring System. Is does exactly that. It monitors the Battery and nothing else. To be specific it monitors the general health and state of charge along with charge and discharge. Now with that information the Variable Voltage System will make its adjustments accordingly. Beyond that there isn't really anything special. Many manufacturers including Nissan with my 2012 Frontier do the same thing. Mine just doesn't have a TCU due to the age and Nissan not giving a damn at the time.

 

[TJC]

Long time Unix Sys Admin, who's had to deal with Windows. I feel the same way.

peterb

MS Regedit does give me a similar vibe to Forscan. To a much lesser degree Linux Config files. I still use my fav text editor for them. I was an OS/2 guy on my desktop/laptop, and I moved to Linux 15 years ago and have not looked back. I didn't mind Win 3.1 and Win XP, and even Win 7, once stripped was OK, the rest are bloated junk that I refuse to use.

I spent plenty of time on mainframes using MVS, VMS, and all the associated SW platforms from the first PC up to mainframes. Before that Series 1, System 32,34,36, and 38. That was a long time ago.

I do not like the move to dumb down software interfaces on web apps. But that trend will continue as the population dumbs down.

 

[pboggini]

MS Regedit does give me a similar vibe to Forscan. To a much lesser degree Linux Config files. I still use my fav text editor for them. I was an OS/2 guy on my desktop/laptop, and I moved to Linux 15 years ago and have not looked back. I didn't mind Win 3.1 and Win XP, and even Win 7, once stripped was OK, the rest are bloated junk that I refuse to use.

I spent plenty of time on mainframes using MVS, VMS, and all the associated SW platforms from the first PC up to mainframes. Before that Series 1, System 32,34,36, and 38. That was a long time ago.

I do not like the move to dumb down software interfaces on web apps. But that trend will continue as the population dumbs down.

Yea, I was at IBM for 7 years, dealt with BSD 4.3 on the RT and PS/2, AIX, OS/2 and Windows 3.1.

Fond memories of putting IBM Palo Alto on the internet, getting a whole /24 for IP's and making all my own cat 3 patch cables.

Dumping regedit output to text files, copying them to Unix machines and doing diff's was also fun.

I guess I'm off topic for my own post aren't I? .

peterb

 

[TJC]

Yea, I was at IBM for 7 years, dealt with BSD 4.3 on the RT and PS/2, AIX, OS/2 and Windows 3.1.

Fond memories of putting IBM Palo Alto on the internet, getting a whole /24 for IP's and making all my own cat 3 patch cables.

Dumping regedit output to text files, copying them to Unix machines and doing diff's was also fun.

I guess I'm off topic for my own post aren't I? .

peterb

I wouldn't worry about it too much as It really doesn't matter. I just raised that issue and I'm awaiting a response. I think it is rather subjective at this point in time.

I put the first Lotus Notes Server in IBM years ago.

I actually tested the IBM Token Ring Network before Ethernet took off. That was a long time ago.

I'll get back on topic now.

 

[airline tech]

As far as wiring diagram of the TCU:
It's a simple Power (Always Hot) and Ground and (3 ea.) Antennas
TCU - Internal Antenna
TCU- Antenna (Mounted) in the Dash above the steering wheel, this is a Booster Antenna for the Internal Antenna -Mostly for (In-Cab) WI-FI Hotspot connections

Then the Cellular - Antenna (Which is a combo antenna)
This is the Antenna mounted on the Roof - AM/FM - GPS-Satellite - One Antenna & Cellular Antenna
Incorporated into (1) Unit - These are the 2 separate coax cables running to it.

Now there is the Data (Bus) = HS4 Can Data Bus
So, Ford Pass, connects via Cellular data to the TCU, the TCU Triggers (On) powers
and withing the Data Bus communication HS4.

There are only (2) Modules on the HS-4 Data Bus - The TCU & APIM
So, you have all the modules on the network and the various Can Busses all connected to one Module (The Gateway Module - GWM)
The Following Data is sent to the TCU from the GWM along the HS-4 Can Bus.
The TCU is only a (Receiving) Module per the Text Data, but with the Cellular Network it can tap into that data and (Change) the status of the various (Ford Pass Controlled) Inputs, this being
Door Lock & Ignition Status - Which will transmit over HS-4 to the GWM which then sends the request over HS-1 Data Bus (The Controlling Bus) for both Door Lock & Ignition Status
The (Vehicle Location) comes direct from the APIM's Current (GPS) Data so this explains why updating the Sync Software cures the (Hey- My Vehicle Location) has not updated as it is a direct link to the TCU and also is on the HS-4 Data bus, that is shared by the TCU.
So APIM (Issues) Sync - HS-4 Data Bus Issues and the TCU (Itself) can be the cause of any Ford Pass (Complaints)

TCU - Network Input Messages that the TCU sees from the other modules and networks and receives from the GWM via HS-4 Can Data Bus with one exception the APIM is a direct Link for GPS Data

Now the internals of the TCU (Being basically a Modem) has internal Authorization standards and protocols imbedded into it. These can be seen with a scan tool.

I put together a T-Shooting Guide - From the Manuals that would fit on one page for a Quick Reference:

The Highlights of This Guide:
Is the ESN Displayed? (SYNC Screen)
What is the PID Data of the TCU showing (Scan Tool)
a. Cellular Strength
b. Authorization Mode - Authorized

I had to shrink it down to fit on one page:

 

[TJC]

Well, that is succinct!

Sponsored