Hi!

I’ve been trying to find the PID for the TPMS sensors in order to add this in Torque. I have a OBDLink MX bluetooth, and I am able to read the tire pressures using FORScan. I’ve logged the bluetooth data while reading the TPMS info, but I’m having trouble making Torque use this info..

It’s on a 2005 Ford Expedition.

The HEX stream shows it finding the following module headers:

1. 7E0, 7E8
2. 7DF, 7E8
3. 761, 769
4. 760, 768
5. 720, 728
6. 755, 75D
7. 744, 74C
8. 733, 73B
9. 720, 728
10. 700, 708

TPMS is integral to what is called the Vehicle Security Module, or VSM. It is listed in FORScan as the 7th module discovered, but I am not sure if this corresponds to the 7th header identified in the hex data.

When I set FORScan to start streaming the TPMS data, it seems like it queries module header 755 before commanding the PID, as I see the string “ATSH000755” first in the data stream. It then receives the response “OK” and then sends the command “22C1271” which responds “62C1278A8B8A89”. From this, I gather that 62C127 is an acknowledgement and then byte 8A is Tire 1, 8B tire 2, 8A tire 3 and 89 tire 4. This seems to match the information displayed in FORScan, two tires has identical value, one is slightly lower, the other slightly higher. So far so good. But, the problem is, PID “22C1271” has one too many characters, it’s not a 3 byte code.. If I enter 22C127 I get a 7F response, regardless if I try the different headers. The only thing I can think of is to try a full PID scan, but that takes ages. Is there anyone that is able to make sense of the “22C1271” command that I see in the logged stream? I can share the captured data in a hex file, if needed.

I tried, it was added as a freeze frame data 022c1271….

Try the terminal to issue commands such
https://play.google.com/store/apps/details?id=com.drively.elmterminal
atz
atsp6
atsh755
atfcsh755
atfcsd300000
atfcsm1
atcra75d
22c127

may still need a team initialize communication started, I did not familiar with Ford

Ok, did some more digging in the captured data, and I found the command sequence it uses when initializing communication, scanning modules and loading DTC data, and then finally when starting to stream the TPMS data. I skipped the part where it’s requesting data from all modules and checking DTC and came up with this command sequence:

ati
sti
stp53
atpc
ate0
atl0
ath0
atr1
atst32
ats0
atat1
atcaf1
attp6
atat0
atal
ati
atsh000755
22c127

At first, it did not give a good response (NO DATA), but after closing ELM Basic and re-initializing the module, it actually gave me a good response using PID 22C127. It seems it has to somehow initialize communication to that specific module before setting header to 000755, not sure why. I tried to enter 000755 as header in Torque, but it still gives me NO DATA… I assume I have to play around with those commands in order to find the correct sequence. I did notice that when entering “ate0” it seems to go into a different mode. In ELM Basic it no longer shows my entries after I enter that particular command..

The xx, do you mean 1000, 1001, 1002 and so on, or 101000, 101001, 101002 and so on?

Where xx equals 00 through FF in
hex. The leading ’10’ represents mode
10 (diagnostics enable?).

(For example a Jeep thread uses 1092 hex
to get TFT pid to work).

Edit:

I am wondering if it is a read timeout
issue since your command list did not
include a mode 10 call which suggests
your other app didn’t need it?