I'm often asked how the modules in Ford 10+ communicate. It seems that the base assumption is that its very "analog", and things are event driven. When in fact its very digital, serial, and implements a ton of parallelism. I'm going to do a brief overview of the CAN bus used in our Mustangs, trucks, etc.

I'm going to keep this very high level, and hopefully down to where anyone can understand it. It always makes the most sense in my head, and sometimes I have a hard time getting out to the average Joe.

What is CAN? And why would I care?
You probably dont care, but i'm sick this week so I need something to do

CAN stands for Controller area network. Its a communications network very similar to Ethernet used in most 2005+ Ford vehicles. It allows for modules to communicate on the same network without a host module. The technology was originally build by Robert Bosch GmbH in the late 80's for both Automotive use and Industrial communications.

How does it work?
Simple, lets take for example you have 2 Microcontrollers(or modules/MCU) that you want to communicate to each other. Both must have a CAN driver and CAN transceiver. A twisted pair of copper wire is connected between the modules. (They both will share a common communications ground).

(See attached Picture)

The Idea behind CAN is that modules can communicate quickly, with low collisions. Each module can send and receive data, but not simultaneously. Meaning, that only one module on the entire network can be transmitting at the same time. With that said, all the modules will be listening.

It also has some great safety features built in such as Fault Confinement, Error Detection Message, Validation, etc. With the ability for Arbitration, Information routing, message framing.

How does the Mustang implement the topology?
The 2010-2014 Mustangs have 2 CAN networks HSCAN and MSCAN. They are twisted pair networks run throughout the car.

HSCAN - Runs at 500Kbps. It is the fastest of the two networks, and all mission critical systems communicate here. Here are some modules on this network.
PCM - Powertrain Control Module - 0x7E0
ABS - Anti Lock Brake System - 0x760
IPC - Insturment Panel Cluster - 0x720
PSCM - Power Steering Control Module - 0x730
RCM - Restraints Control Module - 0x737

MSCAN - 125kbs. It is the slowest of the two networks, and most non mission critical items reside here such as infotainment. Here are some modules on this network
IPC - Instrument Panel Cluster
BCM - Body Control Module
ACM - Audio Control Module
APIM - Accessory Protocol Interface Module
FCIM - Front Controls interface module
FDIM - Front Display Interface Module
GPSM - Global Positioning System Module
HVAC -
etc

At some times though information from the HSCAN bus needs to be relayed on the MSCAN bus. The Instrument cluster serves the functions of translating and re transmitting data from the HSCAN bus to MSCAN both. It is connected to both networks.


Ok, So now I know how they are connected. What does the data look like?
Very simple actually. When you deal directly with a host controller, most of all the work is already done for you. You do not need to calculate Arbitration, CRC or EOF.

A can message has 2 Major parts. An Arbitration ID (CanId) and the Message data itself. If your a developer take the following for consideration.
public CanMsg
{
public int CanId;
public byte[] Data;
}

In the situation of our cars, typically there is 2 bytes of ArbId, and 8 bytes of Data. For example a message could look like this (in Hex)
ArbId = 0x7B7 Data = 00 34 22 AC 33 FF FF FA

There is tons and tons of data on the CAN bus networks, way more than most MCU's can handle. So each individual MCU relies on input filtering. While the message is transmitted on the bus, the MCU looks at the first few bytes of the ARB Id, if it does not match the current filter the message is discarded. So when you are reverse engineering data on the network, be sure to use Filters and Masks. (I can cover this in detail if desired)

Each individual module/mcu listens for data based on the filter. For example, the PCM is listening on 0x7D0 and 0x7E0. One is for diagnostics, while the other is for programming. (I put a few in the list above, you can find a complete list in PTS)

Ok, So what?
Typically that would mean nothing to a typical person, but when you start to analyze the frame against events that are happening in the car you can see bytes change.

For example (not real)
Passenger door closed - ArbId = 0x7B7 Data = 00 AA BB CC DD FF FF FA
Passenger door opened - ArbId = 0x7B7 Data = 01 AA BB CC DD FF FF FA

Notice that the first byte of data change when the door was opened. This can apply to anything, such as when your headlights are on, turn signals, fuel level, steering wheel angel, etc.

Pretty much all the states of anything is transmitted at a regular basis.


How can I see this data?
Easy, there are several CAN bus interfaces out there on the market. One of my personal fav's is ECOM. However, you have to either design your own application or purchase their ridiculously expensive software. Another is CANdo.

Currently if you have a J2534 Interface module (such as a VCM II) I have an application that will be released tonight that will give you the ability to monitor CAN data on the HSCAN network. I'm still riding the fence if I want to make it open source or not (input welcome). It will be released in binary form for sure.


Does this apply to a tuner?
Yes! This is the method that a tuner talks to your PCM. It uses the HSCAN bus to receive and transmit data. In another post, I'm going to cover in depth on how a tuner works. I'm seriously considering releasing an open source tuner. I'm tired of SCT's crap really.

So there is a very quick rundown of CAN bus and Mustangs. I am by far an expert in the field, I do enough just to keep my job All questions or comments are welcome!

Cheers
-Matt

 

Another way to read and send data is Vector CANalyzer. I use that for work (also working in the auto industry ). According to your diagram there is a 120 Ohm termination on the bus, so if you're using one of these tools you'll need to make sure the connector harness uses 120 ohm termination as well. If I'm reading that right.

 

lol, I should had known there would be another engineer here. Should had put "not to scale" on the image (was stolen from wikimedia)

You are correct. There is 2 terminations on the bus (IPC, PCM). I have added nodes without termination and it seemed to work ok. Most of the time I just add the ability onto my PCM with GPIO controlled fet for switching that path on or off. Just depends.

Are the CANalyzer's expensive? (We use them as well, but I dont handle purchasing, we got a guy for that lol) I thought they were way out of the reach of hobbiest on a price level.

 

Haha, there are a few engineers on this forum lurking about

Thanks for posting the info, and yes, you're right. Vector goodies are prohibitively expensive. ~$1k for the CANcase itself, plus double that for the actual software to run it. Too much for a hobby. Unless you already have the software on your work laptop

I use it to intercept and modify messages for fault insertion between ECUs and Sensors. Then create failures and evaluate if the detection time and failsafe mode entered is correct.

 

Glad to see people here speak my language . I'm a software developer with a Electrical Engineering degree.

 

Same here. Computer Engineering undergrad. Also worked in software development

 

There are a few of us.

 

You Engineers think you know everything. How hard is it to drive a train, its on rails and doesn't even have a steering wheel

 

Good one!

 

Trains don't have steering wheels? Poor design decision... Need 3 hour meeting about this with Developers, Management, BA, and QA.

 

Yeah - but can you do the standing mile while pulling a mile of freight?

 

zeroaviation
The VCM has the capability to program the vehicle options at the can bus dlc. Most of the information is based on the asbuilt codes from the factory. However if changes have been made to modules at the dealers, at that point the asbuilt data is no longer applicable. The VCM can download and transfer the data from old module to new module and that is fine, but how do you convert the downloaded information to the same programing code as the asbuilt.

AL

 

I'm not sure I understand your question.

ASBUILT codes rarely change.

When you do a PMI, yes, it is automatic. There is no conversion necessary.

-Matt

 

Hi Matt
My question is that the asbuilt code are set when the vehicle leaves the factory. When the dealer or anyone can change the program settings to the PCM, the ACM ie. My question is can you convert the saved information that you inhale when reprograming a new unit to codes like the codes that are on the asbuilt data sheet.

Thanks Al

 

Al, are you wondering about getting the right programming to get sync to work properly in your 05-09? Direct Matt to the thread, he can help.

 

A dealer will never change as-built codes. They will re-load them if necessary for a module swap .. but would never change them to be anything different than factory original.

As far as your question ... if for example you purchase a used ACM or ICP from a junkyard and want to actually see and save the original AS-BUILT in those modules - you cannot do that with IDS. IDS may be able to backup the as-built and restore those values to a new module .. but they are not available for the IDS user to see or manipulate.

But ... you can easily see the AS-BUILT that are in those modules if you have the VIN from the donor Car.

 

Wow this is waste of a read. Should have titled this one (look what I know). So to most people here, none of this informations matters. Now my ash tray and glove box can talk to my doors and transmission. One big communicating family under one roof. To a few that are trying to put factory accessories in their car from newer models, it matters a little I guess. But I have questions for all the engineers that obviously like to share knowledge. We all now know what CAN is from you guys now.
Why do we need it?
What are the advantages?
This is why I ask. They don't save on wiring. If anything it only complicated a very simple system or function. Now a switch or motor will not work because a module won't communicate. The systems are still 12V so what's wrong with switches and relays? They are reliable and proven. I don't design communication systems but my background is repairing them after you guys call them great. Diagnostics, reliability, and repairs, are something that is not a concern when you're in a cubicle. I deal with engineers every day. If you can tell me why we need to do it your way, maybe I might consider it. Unfortunately the answer usually is only the pursuit of technological advancements because it's not necessary. Engineers just need job justification and manufacturers like to say they have the latest technology even though they don't need it. It's high dollar bragging rights that cost us more in the long run. Thanks a lot guys. Lol

 

When you are done with the box, make sure you put the soap back in it.

 

Hi Jim
No my system is working as programed. I would just like to retrieve the codes, in my case the 727 ACM codes that are currently on my ACM. I know I can inhale and transfer the code to a new ACM with the VCM, but I would like to see the 727 code that it is transfering.

Al

 

Go here:

http://www.vrep.fordtechservice.deal...R_Quickstart=#

Input your VIN into the web address instead of the one given. You will see the as built codes for all your modules in the car.