Used BCM with IDS FAIL IO Terminal Saves the Day
I was called out to program a BCM on a Ford Explorer that is a police SUV. The customer stated that the car would not start. When I got there I noticed the key was not a chip key. Just a normal plastic head key. I thought this very strange as I had not seen a 2016 Ford that did not have security. I went ahead programming and discovered half way through the job that the VIN in the BCM was not correct. They had not told me it was used. When I questioned the service advisor on the used part, he told me that the part was on a national back order and none were available new.
I continued on and the process seemed to be working fine until I got to the parameter reset part. The parameter reset failed. I went back and checked for codes. There were multiple codes for PATS in the BCM and a P 161A in the PCM. I went down a rabbit hole thinking that the upfitter had somehow programmed the security out of the vehicle as per city request. After discussing with upfitter, they told me that PATS was not a system they worked with. So I was quite confused on what was going on.
I pulled back and took a 30,000 ft view of the situation. The vehicle ran before switching out the BCM. So something about the replacement is causing the error. It appeared that once PATS is activated in BCM, it is there for good. At least using conventional IDS method. I decided to use IO Terminal to go at it a different angle. I had not brought my breakout box so had to go back to office to address. I connected to original BCM and read out the Pflash and Dflash. I then connected to Donor and wrote Pflash and Dflash from original to the donor. I now had a carbon copy of the original. I had feared that by attempting the first time I had contaminated the PCM. I programmed the PCM to latest calibration. (With the cloned BCM installed.) Still no start. I then did the parameter reset again and it flew right through. Now the vehicle starts.
From this I have come to these conclusions. 1) Police cars and maybe other fleet cars/trucks/SUVs have the option of getting non-immobilizer vehicles even as late as 2016. 2) It is not possible with conventional methods to add a PATS active BCM to a non-PATS application. 3) By using IO Terminal with the Ford BCM license, one can copy data from the original BCM and transfer to used donor. 4) If I had not first attempted to marry donor BCM to this vehicle, the cloning process would have likely ended in a plug and play situation.
One thing I do not have a firm grip on is if both applications were PATS active, would the used part have worked using IDS? I think the answer is yes, however it is becoming harder to use second hand parts with OE applications.
Rare if ever I see interceptor to have immobilizer friend
Do you have both files? Be interesting to look and see if the pats section in the bin file can be found it may be useful if one could use ioterminal to turn pats off in the bcm on newer fords…
Very nice idea friend but how to work through pcm as well?
The bcm is the theft controller on most if not all of the newer fords. the pcm will allow starting if the bcm does, it would not repair an issue between bcm and pcm and a parameter reset would still need to be done if a module was changed (unless it was cloned) but it could fix immobilizer for say a construction company that runs 15+ pats equipped f350's and wants 10 keys for each or…
Interesting idea I will test this if someone can post up files for checking
Thank for the case study. What is pflash and dflash? Where does one get ioterminal and learn to use it?
Michael Kotarba, For IO Terminal, there are two US and one Canadian distributor. Basic training usually comes with the tool from the distributor. We go over IO Terminal in our classes quite extensively. Inside the Microcontroller there are sections of memory. DFlash would be similar to an EEPROM that contains data that can be easily changed. For instance adding a key or writing in a VIN…
Thank you Michael for the explanation of the software and hardware needed.
The police interceptors in my fleet don't have pats either.
Andrew C Deorio and Manuel Marques, Since I rarely see police cars, this was new to me. I guess it is more common than I thought.
It helps at the rate they misplace keys.
I just did some work recently on a 2021 Ford Police Interceptor, still no PATS in them. Typically PDs will have all like vehicles keyed the same so an officer can jump into any of their vehicles and get moving when the situation requires.
does I/O do them through OBD or had to bdm? Important stuff is in unsecured 9S12 so very easy to bdm with pretty much any bdm tool. I didnt read all your post but, doing as-build with IDS may would have programmed it properly. From my experience comparing a lot of RCM's before and after as built programming it looks to me that it reconfigure's most of the settings found in eeprom (which is…
Jason Anthony, The IO Terminal reads the MCU over CAN. Ford is using different MCUs nowadays so there are many variants to consider. These have the EEPROM data in DFlash.
Thanks! sure does make it easier then having to remove it. Most all the bcms I remember of that style is 9s12XEP768 inside. Fords has always liked motorola/nxp mcus the most it seems in my experience. The eeprom is emulated in dflash that is true but when your working with it you still want to read the “eeprom” sector to see it as a typical eeprom memory. If you try and just read the dflash its…
Jason, this is a neat example! Is it common knowledge how to go (by hand) from emulated EEPROM data to the actual EEPROM values? If no, is it possible to provide the files for demonstration purposes?
I doubt anyone has bothered how to figure out the conversion on the ford ones since its not really needed much but its common on the FRM's (bmw foot-well module) to recover the eeprom by hand from dflash. Its such a common problem they loose the memory. I will send you these ford ones after xmas tomorrow, and some bmw ones as well if your interested in those.
Thank you, Jason, you can find my e-mail in the notes for the DNTs I sent you.
Dmitriy, In many cases the tools we use will show what portion of the flash is devoted to Dflash (EEPROM for demo purposes) and Pflash. So there is a specified division. In many Exx GM PCMs there is an emulated EEPROM which is part of the flash. Tools like IO Terminal will separate this part of the flash out so one can work with VIN and immobilizer data. So far, I have not seen any breakdown…