Playing with CAN

[cilynx]

Since basically everything is on CAN buses, I need to do some research here and figure out how to at least listen and hopefully interact.

[cilynx]

http://openxcplatform.com/ looks interesting. Kinda surprised I've never heard of it before. Looks like it's read-only and actively hides the CAN codes in binary firmware, translating them to a public API. Might be fun to play with when getting started to avoid borking anything.

[cilynx]

CAN buses on the 3rd-gen Expedition w/ Sony sound:

[cilynx]

Collection of CAN codes by vendor: https://github.com/iDoka/awesome-automotive-can-id
More CAN codes: https://community.carloop.io/t/list-of-can-id-descriptions-from-opengarages-org/104
Ford CAN code thread: https://groups.google.com/g/openxc/c/FrZA8-pDs6A

This Derek dude, has several good posts:

• https://derekwill.com/2020/12/05/can-bus-reverse-engineering-finding-the-vin/
• https://derekwill.com/2020/12/24/can-bus-reverse-engineering-door-status/
• https://derekwill.com/2021/05/12/can-bus-exploring-other-worlds-ms-can/
• https://derekwill.com/2021/05/12/can-bus-reverse-engineering-door-status-part-2/

Arduino Uno + Canbus Shield, MS-CAN, HS-CAN:
HS-CAN - 500Kbps - Engine/Temp/etc... data
OBD-II pins:

• 6 - HS-CAN+
• 14 - HS-CAN-

I-CAN - 500Kbps - Entertainment data
OBD-II pins:

• 1 - I-CAN+
• 8 - I-CAN-

MS-CAN - 250Kbps?? 125Kbps?? - HVAC, GPS/NAV, Rear hatch, Entertainment, door locks/windows if modules are present, memory seat, trailer module, etc... data
OBD-II pins:

• 3 - MS-CAN+
• 11 - MS-CAN-

[cilynx]

Name	Abbreviation	Numeric	Speed	+	-
High Speed Controller Area Network	HS-CAN	CAN1	500 Kbps	6	14
Medium Speed Controller Area Network	MS-CAN	CAN2-1	125 Kbps	3	11
Infotainment Controller Area Network	I-CAN	CAN2-2	500 Kbps	1	8
SAE J1850 PWM			41.6 Kbps	10	2

SAE J1850 PWM (41.6 kbaud, Standard of the Ford Motor Company)
pin 2: Bus-
pin 10: Bus+
High voltage is +5V
Message length is restricted to 12 bytes, including CRC
Employs a multi-master arbitration scheme called
"Carrier Sense Multiple Access with Non-Destructive Arbitration" (CSMA/NDA)

[cilynx]

Abbreviation	Name	Function
ABS	Anti-Lock Braking System Module	Primary computer for your antilock brakes
ACM	Audio Control Module
APIM	Accessory Protocol Interface Module	SYNC's primary computer
BCM	Body Control Module
DSP	Digital Signal Processor	Similar to an RCU -- an all-in-one module that often contains amplifiers, crossovers, balance/fade controls, etc.
FCDIM	Front Controls Interface Display Module	The display for the FCIM -- LCD, touchscreen, etc
FCIM	Front Controls Interface Module	Human interface (buttons and such) for A/C, infotainment, navigation, etc.
IPC	Instrument Panel Cluster
PCM	Powertrain Control Module	Primary computer for the engine and transmission
RCM	Restraint Control Module	Airbag controller
RCU	Rear Chassis Unit / Radio Control Unit	Most of the "guts" of the radio. Tuner, amplifier, etc. The stock head unit you interact with is basically a remote control
SCCM	Steering Column Control Module	Interface module for your steering wheel / column controls

(Assembled from several sources)

Also, these look interesting:

• https://github.com/bigunclemax/Focus3IPCThemeEditor
• https://github.com/bigunclemax/FTools

[cilynx]

Pin	Signal	Circuit	Description
2	J1850 Bus+ / SCP Bus	914 (TN/OG)	ABS and others or not used
3	Medium speed CAN+ or UBP bus	2180 (WH/BK) or 1906 (VT)	Low speed (125Kb) CAN bus. This bus used for some IC, RFA and other units.
4	CGND	57(BK)	Chassis ground
5	SGND	570(BK/WH)	Signal ground
6	CAN High	1827(WH/LB)	High Speed CAN+
7	K-LINE	70(LB/WH)	ISO Bus
10	J1850 Bus-	915(PK/LB)	SCP bus-
11	Medium speed CAN-	2181(BK/YE)	Low speed CAN-
13	PCM	107(P) / 107(VT)	Power Train Control / Module programming signal
14	CAN Low	1828 (PK/LG)	High Speed CAN-
16	+12v	40(LB/WH)	Battery power

https://pinoutguide.com/CarElectronics/ford_obd_2_pinout.shtml

[cilynx]

Heated / Cooled Seats

H, M, L, Off

Heat

124 - 80, 40, 20, 2 Driver is top bytes, Passenger is second byte pair
125 - 80, 40, 20, 2 Driver is top bytes, Passenger is second byte pair
356 - 98, 90, 88, 0 Driver is top bytes
26, 24, 22, 0 Passenger is second byte pair
358 - 70, 50, 30, 0 Driver is first pair
70, 50, 30, 0 Passenger is third pair
35C - 18, 10, 8, 0 Driver - heat
3, 2, 1, 0 Passenger - heat
30, 28, 20, 0 driver cool
6, 5, 4, 0 Passenger cool
Driver and Passenger add together to make the 5th byte pair

Cool

124 - 10, 8, 4, 2
125 - 10, 8, 4, 2
356 - 58, 50, 48, 0
- 16, 14, 12, 0
358 - 68, 48, 28, 0
68, 48, 28, 0

[cilynx]

Confirmed today that we need to be able to talk on I-CAN to control the audio amplifier, but it keeps settings set on the OEM head when you switch to the new one.