Used BCM with IDS FAIL IO Terminal Saves the Day

Michael Mobile Technician Utah Posted   Latest  
Case Study
Programming
Security
2016 Ford Police Interceptor Utility 3.7L (R 99R Gas) 6-spd (6F55) — 1FM5K8ARXGGA37341
P161A
No Crank / No Start

I was called out to program a BCM on a Ford Explorer that is a police SUV. The customer stated that the car would not start. When I got there I noticed the key was not a chip key. Just a normal plastic head key. I thought this very strange as I had not seen a 2016 Ford that did not have security. I went ahead programming and discovered half way through the job that the VIN in the BCM was not correct. They had not told me it was used. When I questioned the service advisor on the used part, he told me that the part was on a national back order and none were available new.

I continued on and the process seemed to be working fine until I got to the parameter reset part. The parameter reset failed. I went back and checked for codes. There were multiple codes for PATS in the BCM and a P 161A in the PCM. I went down a rabbit hole thinking that the upfitter had somehow programmed the security out of the vehicle as per city request. After discussing with upfitter, they told me that PATS was not a system they worked with. So I was quite confused on what was going on.

I pulled back and took a 30,000 ft view of the situation. The vehicle ran before switching out the BCM. So something about the replacement is causing the error. It appeared that once PATS is activated in BCM, it is there for good. At least using conventional IDS method. I decided to use IO Terminal to go at it a different angle. I had not brought my breakout box so had to go back to office to address. I connected to original BCM and read out the Pflash and Dflash. I then connected to Donor and wrote Pflash and Dflash from original to the donor. I now had a carbon copy of the original. I had feared that by attempting the first time I had contaminated the PCM. I programmed the PCM to latest calibration. (With the cloned BCM installed.) Still no start. I then did the parameter reset again and it flew right through. Now the vehicle starts.

From this I have come to these conclusions. 1) Police cars and maybe other fleet cars/trucks/SUVs have the option of getting non-immobilizer vehicles even as late as 2016. 2) It is not possible with conventional methods to add a PATS active BCM to a non-PATS application. 3) By using IO Terminal with the Ford BCM license, one can copy data from the original BCM and transfer to used donor. 4) If I had not first attempted to marry donor BCM to this vehicle, the cloning process would have likely ended in a plug and play situation.

One thing I do not have a firm grip on is if both applications were PATS active, would the used part have worked using IDS? I think the answer is yes, however it is becoming harder to use second hand parts with OE applications. 

diag​.​net/file/f5gfo11c2…

+15
Helpful
Thanks
Interesting
Manuel Diagnostician
New Jersey
Manuel
 

Rare if ever I see interceptor to have immobilizer friend

+2
Ð Awarded
Scott Owner/Technician
Michigan
Scott
 

Do you have both files? Be interesting to look and see if the pats section in the bin file can be found it may be useful if one could use ioterminal to turn pats off in the bcm on newer fords…

+2
Ð Awarded
Helpful
Interesting
Manuel Diagnostician
New Jersey
Manuel
 

Very nice idea friend but how to work through pcm as well?

0
Ð Awarded
Scott Owner/Technician
Michigan
Scott
 

The bcm is the theft controller on most if not all of the newer fords. the pcm will allow starting if the bcm does, it would not repair an issue between bcm and pcm and a parameter reset would still need to be done if a module was changed (unless it was cloned) but it could fix immobilizer for say a construction company that runs 15+ pats equipped f350's and wants 10 keys for each or…

0
Ð Awarded
Manuel Diagnostician
New Jersey
Manuel
 

Interesting idea I will test this if someone can post up files for checking

0
Ð Awarded
Michael Technician
Massachusetts
Michael
   

Thank for the case study. What is pflash and dflash? Where does one get ioterminal and learn to use it?

0
Ð Awarded
Michael Mobile Technician
Utah
Michael
   

Michael Kotarba, For IO Terminal, there are two US and one Canadian distributor. Basic training usually comes with the tool from the distributor. We go over IO Terminal in our classes quite extensively. Inside the Microcontroller there are sections of memory. DFlash would be similar to an EEPROM that contains data that can be easily changed. For instance adding a key or writing in a VIN…

+3
Ð Awarded
Thanks
Michael Technician
Massachusetts
Michael
 

Thank you Michael for the explanation of the software and hardware needed.

0
Ð Awarded
Andrew Diagnostician
New York
Andrew
 

The police interceptors in my fleet don't have pats either.

0
Ð Awarded
Michael Mobile Technician
Utah
Michael
 

Andrew C Deorio and Manuel Marques, Since I rarely see police cars, this was new to me. I guess it is more common than I thought.

0
Ð Awarded
Andrew Diagnostician
New York
Andrew
 

It helps at the rate they misplace keys.

+3
Ð Awarded
Funny
Agree
Bruce Owner/Technician
Texas
Bruce
 

I just did some work recently on a 2021 Ford Police Interceptor, still no PATS in them. Typically PDs will have all like vehicles keyed the same so an officer can jump into any of their vehicles and get moving when the situation requires.

0
Ð Awarded
Jason Owner/Technician
Virginia
Jason
 

does I/O do them through OBD or had to bdm? Important stuff is in unsecured 9S12 so very easy to bdm with pretty much any bdm tool. I didnt read all your post but, doing as-build with IDS may would have programmed it properly. From my experience comparing a lot of RCM's before and after as built programming it looks to me that it reconfigure's most of the settings found in eeprom (which is…

0
Ð Awarded
Michael Mobile Technician
Utah
Michael
 

Jason Anthony, The IO Terminal reads the MCU over CAN. Ford is using different MCUs nowadays so there are many variants to consider. These have the EEPROM data in DFlash.

0
Ð Awarded
Jason Owner/Technician
Virginia
Jason
   

Thanks! sure does make it easier then having to remove it. Most all the bcms I remember of that style is 9s12XEP768 inside. Fords has always liked motorola/nxp mcus the most it seems in my experience. The eeprom is emulated in dflash that is true but when your working with it you still want to read the “eeprom” sector to see it as a typical eeprom memory. If you try and just read the dflash its…

0
Ð Awarded
Dmitriy Analyst
Ontario
Dmitriy
 

Jason, this is a neat example! Is it common knowledge how to go (by hand) from emulated EEPROM data to the actual EEPROM values? If no, is it possible to provide the files for demonstration purposes?

0
Ð Awarded
Jason Owner/Technician
Virginia
Jason
 

I doubt anyone has bothered how to figure out the conversion on the ford ones since its not really needed much but its common on the FRM's (bmw foot-well module) to recover the eeprom by hand from dflash. Its such a common problem they loose the memory. I will send you these ford ones after xmas tomorrow, and some bmw ones as well if your interested in those.

0
Ð Awarded
Dmitriy Analyst
Ontario
Dmitriy
 

Thank you, Jason, you can find my e-mail in the notes for the DNTs I sent you.

0
Ð Awarded
Michael Mobile Technician
Utah
Michael
 

Dmitriy, In many cases the tools we use will show what portion of the flash is devoted to Dflash (EEPROM for demo purposes) and Pflash. So there is a specified division. In many Exx GM PCMs there is an emulated EEPROM which is part of the flash. Tools like IO Terminal will separate this part of the flash out so one can work with VIN and immobilizer data. So far, I have not seen any breakdown…

0
Ð Awarded
Dmitriy Analyst
Ontario
Dmitriy
 

Michael, thanks for the details, it’s great the tools help so much to manipulate the data. VIN does have a check digit for cars sold in North America, it would be a fun topic to discuss someday.

+1
Ð Awarded
Interesting