Playing with CAN about expedition HOT 8 OPEN

http://openxcplatform.com/ looks interesting. Kinda surprised I've never heard of it before. Looks like it's read-only and actively hides the CAN codes in binary firmware, translating them to a public API. Might be fun to play with when getting started to avoid borking anything.

from expedition.

CAN buses on the 3rd-gen Expedition w/ Sony sound:

from expedition.

Collection of CAN codes by vendor: https://github.com/iDoka/awesome-automotive-can-id
More CAN codes: https://community.carloop.io/t/list-of-can-id-descriptions-from-opengarages-org/104
Ford CAN code thread: https://groups.google.com/g/openxc/c/FrZA8-pDs6A

This Derek dude, has several good posts:

• https://derekwill.com/2020/12/05/can-bus-reverse-engineering-finding-the-vin/
• https://derekwill.com/2020/12/24/can-bus-reverse-engineering-door-status/
• https://derekwill.com/2021/05/12/can-bus-exploring-other-worlds-ms-can/
• https://derekwill.com/2021/05/12/can-bus-reverse-engineering-door-status-part-2/

Arduino Uno + Canbus Shield, MS-CAN, HS-CAN:
HS-CAN - 500Kbps - Engine/Temp/etc... data
OBD-II pins:

• 6 - HS-CAN+
• 14 - HS-CAN-

I-CAN - 500Kbps - Entertainment data
OBD-II pins:

• 1 - I-CAN+
• 8 - I-CAN-

MS-CAN - 250Kbps?? 125Kbps?? - HVAC, GPS/NAV, Rear hatch, Entertainment, door locks/windows if modules are present, memory seat, trailer module, etc... data
OBD-II pins:

• 3 - MS-CAN+
• 11 - MS-CAN-

from expedition.

SAE J1850 PWM (41.6 kbaud, Standard of the Ford Motor Company)
pin 2: Bus-
pin 10: Bus+
High voltage is +5V
Message length is restricted to 12 bytes, including CRC
Employs a multi-master arbitration scheme called
"Carrier Sense Multiple Access with Non-Destructive Arbitration" (CSMA/NDA)

from expedition.

(Assembled from several sources)

Also, these look interesting:

• https://github.com/bigunclemax/Focus3IPCThemeEditor
• https://github.com/bigunclemax/FTools

from expedition.

https://pinoutguide.com/CarElectronics/ford_obd_2_pinout.shtml

from expedition.

Heated / Cooled Seats

H, M, L, Off

Heat

124 - 80, 40, 20, 2 Driver is top bytes, Passenger is second byte pair
125 - 80, 40, 20, 2 Driver is top bytes, Passenger is second byte pair
356 - 98, 90, 88, 0 Driver is top bytes
26, 24, 22, 0 Passenger is second byte pair
358 - 70, 50, 30, 0 Driver is first pair
70, 50, 30, 0 Passenger is third pair
35C - 18, 10, 8, 0 Driver - heat
3, 2, 1, 0 Passenger - heat
30, 28, 20, 0 driver cool
6, 5, 4, 0 Passenger cool
Driver and Passenger add together to make the 5th byte pair

Cool

124 - 10, 8, 4, 2
125 - 10, 8, 4, 2
356 - 58, 50, 48, 0
- 16, 14, 12, 0
358 - 68, 48, 28, 0
68, 48, 28, 0

from expedition.

Confirmed today that we need to be able to talk on I-CAN to control the audio amplifier, but it keeps settings set on the OEM head when you switch to the new one.

from expedition.