Ford CANbus modules wake-up

[Diver300]

Does anyone know how the CANbus systems on Ford cars control the wake-sleep of the electronic modules?

Some modules on cars have no connections to the rest of the car other than a permanent 12 V supply and CAN, so they have to have some way to agree to go to sleep, in order to take just a few microamps, and to wake up to have the speed of response that they will need when operating.

I've seen how this works on Landrovers and Jaguar cars. The CANbus message IDs in the range 0x500 - 0x5FF are used to keep the bus awake and when those cease, each module stops transmitting, waits a second or so for any more messages in that range, and shuts down.

I think it's quite likely that Ford use something similar, but I wonder if anyone here knows for sure.

 

[rjenkinsgb]

Likely the same on Fords.
There is a lot of overlap between Ford and Jaguar / Land Rover, as Ford owned them for some time..

They definitely all used the same "VCM II" diagnostic interface as Fords for some years & I think Jaguar and Land Rover may still use the same Ford unit?
(Mazda also use that, they have a lot of technology cross-over with Ford as well).

I have a VCM II for my Ford, but not the JLR software.

 

[Diver300]

I agree that there are many similarities. The specific question is about the wakeup messages.

CANbus has several types of message. I think that the types are generally grouped into different ranges of IDs. There are the everyday messages, saying what the car is doing, like speed, engine speed, temperatures, accelerations etc. There are the event messages, like button pressed and certain alerts. There are the configuration messages, for stuff that doesn't change, like fuel type, LHD or RHD, number of doors etc. There are the diagnostic messages, for reading the DTCs, which is what is often read through the diagnostic interface, but in fact those signals are only present when codes are being read. These have higher number, so lower priority, IDs.

As well as all of those, there are the messages that I am looking at, which keep the modules awake or let them go to sleep to save power.

 

[pyrocrazy130]

I am interested in the wake up messages as well. I upgraded the power seats in my truck and the new Driver Seat Module is connected to the medium speed bus. As you said before there is only one Hot At All Times circuit that powers the module, according to the donor trucks wiring diagram. So i would like to create a module that will send the wake up messages when the Hot In Run circuit changes state. I purchased a 2ch CAN interface for a raspi and i have access to a functional truck of the same year as the donor truck. I am new to decoding these signals but I would be glad to give you some CAN dumps or other information. There is very little information on these systems so i would be glad to help out.

 

[Diver300]

Would you be able to get a log of the CANbus from the functional truck? If you can get a log of CAN bus waking up, and one of it shutting down, that would probably give a very good idea as to what the wake-up signals are.

 

[pyrocrazy130]

Yeah, I will let you know when I get the logs.

Quick update on the DSM, I finished making the adapter to connect the new wiring harness to the old and the DSM allows the seats to move without CAN communication. However I was not able to get the seat memory function to work. The old module(non-CAN) seemed to store the position data in itself, I assume the new module does the same. The old module also directly controlled the pedal position where as the new module communicates with the steering column module to command the pedal position. There is also an audible tone that is heard when setting the seat memory position on the new system which I believe is also commanded over CAN. Maybe there is an acknowledgement message sent by another module to allow the memory to be set. There was a feature that changed seat position based on 2 different keys used in the ignition, not sure if this feature was equipped in the donor truck but I suspect I can't get the memory functions to work because I don't have the correct communication to the module yet.

I am working on the A/C controls as well. I hooked up power to the module and it did nothing. So that module must need the wake up commands. Now that my seats move, even though they don't have memory, I'm going to make the A/C controls my primary focus.

I'll record separate sessions, concentrating on specific modules. Any guidance would be welcome since I am new to CAN bus sniffing.

 

[rjenkinsgb]

From my experience with Ford control modules, anything with any complexity may need programming to the vehicle VIN before it functions in a different vehicle...

Whilst that makes sense for security-related parts so the immobiliser cannot be simply bypassed - they also apply it to completely irrelevant items such as the Bluetooth audio module.

I'd not be at all surprised if it also applies to climate control, power seats and any other optional or "luxury" item, to try and prevent DIY replacement or upgrades.

 

[Diver300]

If you are reading the CANbus, make sure that your testing device isn't sending anything. Reading DTCs means that they need to be requesting data, so if that is happening, the car will stay awake.

Your log will read every module that is on the CANbus. The interesting things are working out which ID comes from which module and what those IDs mean.

If you have a module from a donor car and the VIN number is need, and you are simulating the CANbus using a Raspberry PI, you can also fake the VIN number on the CAN so that the module will continue to work.

 

[Diver300]

From my experience with Ford control modules, anything with any complexity may need programming to the vehicle VIN before it functions in a different vehicle...

Whilst that makes sense for security-related parts so the immobiliser cannot be simply bypassed - they also apply it to completely irrelevant items such as the Bluetooth audio module.

I'd not be at all surprised if it also applies to climate control, power seats and any other optional or "luxury" item, to try and prevent DIY replacement or upgrades.

There are two levels with programming the VIN. As you say, some modules are secured to the VIN and will only work when that matches. As you say, for some things that makes a lot of sense, for security or calibration reasons.

However, in my experience of the car industry, most modules are programmed with the VIN only as an electronic security marking. The modules can learn the VIN number of the car that they are on when told to do so, but only once. That can never be changed without completely reprogramming the processor, which can't be done over CAN. It would need the module opening and JTAG or similar to be used. The VIN becomes a fixed item, like the serial number. The stored VIN on most modules, like the serial number of the module, is just that, a number. The stored VIN in modules like this has no effect on the operation in a car, whether or not the VIN transmitted on the CANbus matches.

That is only done to make changing the identity of a car more difficult. All the modules can have the stored VIN read at any time, so if a car is cloned, and the master module with the VIN is changed or reprogrammed, and the physical VIN numbers changed, all the other module would have to be changed in order to hide the old identity. The idea is to make changing a car's identity cost more than buying a new one.

Of course, the technicians at the dealers will tell you that the module has to be programmed with the VIN, because they don't see any difference whether the module would work without programming or not. When they change a module, they plug in the diagnostic computer, it does what it needs to, and the VIN can be read from the new module. The technicians won't ever try an unprogrammed module, and even if it did work, they couldn't be sure that it would work in all conditions. All main dealer repairs are done with new parts, so it make no difference if a second-hand one would be fine, as they will never use it anyhow.

For the owner, programming of that type of module isn't needed. If it's a second-hand module, the VIN can't be reprogrammed, but that won't make any difference. If it's a new module, it will just read out a blank if the VIN is ever read. Either way, it will only be read if the car is suspected of being cloned, and one or two modules, out of 20 or more, showing no VIN or the wrong VIN is just evidence of repair not evidence of the entire car being cloned.

 

[rjenkinsgb]

The modules can learn the VIN number of the car that they are on when told to do so, but only once. That can never be changed without completely reprogramming the processor, which can't be done over CAN.

From my experience with Ford modules, the Ford IDS system with the Bosch VMC II interface unit can reprogram used ones via the OBDII port; I've done it..

Edit -
And functionally, such as the Bluetooth module will _not_ work with a vehicle without the VIN programmed to match!

That's not just ID, it's to prevent DIY changes or repairs.

 

[rjenkinsgb]

[accidental post - trying to correct VMC II to VCM II].

 

[Diver300]

From my experience with Ford modules, the Ford IDS system with the Bosch VMC II interface unit can reprogram used ones via the OBDII port; I've done it..

Edit -
And functionally, such as the Bluetooth module will _not_ work with a vehicle without the VIN programmed to match!

That's not just ID, it's to prevent DIY changes or repairs.

I agree that manufacturers are often using VIN coding to prevent DIY changes.

However, there can also be generic modules that need programming for the details of what is on the car. There might be a door module that fits various cars, each with different window characteristics, so the calibration is specific to a model, a model year, number of doors, hand of drive, and maybe even market that the car is used in. It saves a lot of spares holding to have one type of module that will do all the possible combinations, and just receives a calibration when it is fitted.

I don't think that module can generally be totally reprogrammed. In my experience there is always a primary bootloader, and some data, for instance the serial number of the module, that will not be accessible via CAN. The main application and any calibration etc will be programmable

I've come across modules that need a calibration specific to the application, that is allowed to be reprogrammed many times, while having a VIN storage that is only allowed to run once.

 

[pyrocrazy130]

Sorry this took so long. I was able to log the working vehicle MS CAN Bus and after some trial and error I found that these 10 CAN Frames were able to wake up and allow control of the HVAC module of the donor vehicle.

(1591150697.475434) can1 3E2#000000000000804F
(1591150697.476424) can1 40A#C00000B5275C9300
(1591150697.477428) can1 423#2710096028000000
(1591150697.478400) can1 425#580000E16C80B0D1
(1591150697.479389) can1 426#AA00000000F7FCC0
(1591150697.480447) can1 42C#0000000000000000
(1591150697.481462) can1 10D#0000000000000000
(1591150697.490515) can1 3A0#4500800289240000
(1591150697.500260) can1 3B2#00010C5D4000FE00
(1591150697.510819) can1 3B3#0043051200000038

These messages had to be played in sequence in order for the module to wake up and allow control of the temperature and duct settings. I tried to play them one at a time but it would only wake up the module and flash the illumination LEDs and turn back off. This also happens if you just send any CAN ID. Seems like the illumination function reacts to any valid CAN message, I noticed when you first insert the key into the ignition the illumination in the vehicle will turn on for a moment.

I recorded a session, on the bench, playing the 10 messages once without touching any buttons on the module. I waited a moment and played it again but after the module woke up and allowed control, I pressed the Seat Heater button on the module.

(1591334463.023889) can1 3E2#000000000000804F
(1591334463.024824) can1 40A#C00000B5275C9300
(1591334463.025777) can1 423#2710096028000000
(1591334463.026699) can1 425#580000E16C80B0D1
(1591334463.027653) can1 426#AA00000000F7FCC0
(1591334463.028656) can1 42C#0000000000000000
(1591334463.029657) can1 10D#0000000000000000
(1591334463.037917) can1 3A0#4500800289240000
(1591334463.048562) can1 3B2#00010C5D4000FE00
(1591334463.058146) can1 3B3#0043051200000038

(1591334463.082049) can1 503#030100
(1591334463.142339) can1 583#00
(1591334463.152898) can1 124#0202000000000000
(1591334463.153901) can1 35E#8000000000000000
(1591334463.154935) can1 3E7#0000000000000000
(1591334463.155930) can1 41A#0000FE0000064190
(1591334463.183116) can1 41A#0000FF60A2067590
(1591334463.183737) can1 503#030200
(1591334463.444890) can1 503#030100
(1591334463.545697) can1 503#030200
(1591334463.807775) can1 503#030100
(1591334463.908581) can1 503#030200
(1591334464.160920) can1 124#0202000000000000
(1591334464.161917) can1 35E#8000000000000000
(1591334464.162947) can1 3E7#0000000000000000
(1591334464.163925) can1 41A#0000FF60A2067590
(1591334464.170704) can1 503#030100
(1591334464.271472) can1 503#030200
(1591334464.533555) can1 503#030100
(1591334465.168937) can1 124#0202000000000000
(1591334465.169938) can1 35E#8000000000000000
(1591334465.170975) can1 3E7#0000000000000000
(1591334465.171944) can1 41A#0000FF60A2067590
(1591334465.541592) can1 503#030400
(1591334466.176959) can1 124#0202000000000000
(1591334466.177957) can1 35E#8000000000000000
(1591334466.178988) can1 3E7#0000000000000000
(1591334466.179962) can1 41A#0000FF60A2067590
(1591334466.549611) can1 503#030400
(1591334467.184981) can1 124#0202000000000000
(1591334467.185976) can1 35E#8000000000000000
(1591334467.187008) can1 3E7#0000000000000000
(1591334467.187982) can1 41A#0000FF60A2067590
(1591334467.557629) can1 503#030400
(1591334468.192997) can1 124#0202000000000000
(1591334468.193994) can1 35E#8000000000000000
(1591334468.195026) can1 3E7#0000000000000000
(1591334468.196010) can1 41A#0000FF60A2067590
(1591334468.565651) can1 503#031400

(1591334482.871909) can1 3E2#000000000000804F
(1591334482.872847) can1 40A#C00000B5275C9300
(1591334482.873802) can1 423#2710096028000000
(1591334482.874722) can1 425#580000E16C80B0D1
(1591334482.875800) can1 426#AA00000000F7FCC0
(1591334482.876806) can1 42C#0000000000000000
(1591334482.877822) can1 10D#0000000000000000
(1591334482.879536) can1 503#030100
(1591334482.885921) can1 3A0#4500800289240000
(1591334482.896584) can1 3B2#00010C5D4000FE00
(1591334482.906218) can1 3B3#0043051200000038

(1591334482.980266) can1 503#030200
(1591334483.131845) can1 124#0202000000000000
(1591334483.132841) can1 35E#8000000000000000
(1591334483.133871) can1 3E7#0000000000000000
(1591334483.134843) can1 41A#0000FF60A2067590
(1591334483.242397) can1 503#030100
(1591334483.343188) can1 503#030200
(1591334483.605278) can1 503#030100
(1591334483.706087) can1 503#030200
(1591334483.938442) can1 124#8002000000000000
(1591334483.968357) can1 503#030100
(1591334484.069149) can1 503#030200
(1591334484.139867) can1 124#8002000000000000
(1591334484.140871) can1 35E#8000000000000000
(1591334484.141893) can1 3E7#0000000000000000
(1591334484.142877) can1 41A#0000FF60A2067590
(1591334484.331055) can1 503#030100
(1591334485.147879) can1 124#8002000000000000
(1591334485.148873) can1 35E#8000000000000000
(1591334485.149905) can1 3E7#0000000000000000
(1591334485.150879) can1 41A#0000FF60A2067590
(1591334485.238578) can1 41A#00006460A2067590
(1591334485.339091) can1 503#030400
(1591334486.155904) can1 124#8002000000000000
(1591334486.156900) can1 35E#8000000000000000
(1591334486.157925) can1 3E7#0000000000000000
(1591334486.158897) can1 41A#00006460A2067590
(1591334486.347106) can1 503#030400
(1591334487.164114) can1 124#8002000000000000
(1591334487.165016) can1 35E#8000000000000000
(1591334487.166040) can1 3E7#0000000000000000
(1591334487.167010) can1 41A#00006460A2067590
(1591334487.355225) can1 503#030400
(1591334487.960241) can1 124#0202000000000000
(1591334488.171927) can1 124#0202000000000000
(1591334488.172933) can1 35E#8000000000000000
(1591334488.173961) can1 3E7#0000000000000000
(1591334488.174929) can1 41A#00006460A2067590
(1591334488.363164) can1 503#031400

I added the carriage returns after 10 message recording was played.

I have a lot more logs that i can post on GIT or something. I will be descriptive as possible to what I was trying to capture. If you have any advice on logging/posting the data, it would be greatly appreciated.

 

[Diver300]

I was looking for a much, much longer log showing wake-up on the CANbus. Your burst of 10 messages lasts just 35 ms.

The module is sending messages with id of 0x503, and the behaviour of those messages is the same as the ones that are in the range 0x500 - 0x57F on Landrovers and Jaguar cars. (The ones in the range 0x580 - 0x5FF do the same job, but in a different way)

What I would like to see is a log of the car waking up that lasts about 5 seconds, but only of messages in the 0x500 - 0x57F range. A similar log for shutting down would be useful.

The situation is that modules need to use quite a bit of power to run in a way that they can read CAN messages, so when the car is asleep, the modules can't run in that mode. When the modules are fully asleep, they take virtually no power, but any disturbance on the CAN bus will wake the modules. For waking, that is reasonably easy, as the modules will be woken when the first module wakes. When shutting down there has to be some way that the modules agree to stop transmitting. Obviously the modules will stop at slightly different times, so each module will stop transmitting, and then wait to make sure there are no more messages to do with staying awake, and ignore the other messages. Some time after all messages have stopped, the modules will go to the low power mode.

So any message at all will wake the module, but it may then go to sleep if there are no sleep/wake messages, only to be woken again a moment later.

What happens is that all the modules that form a "ring" with each module transmitting 100 ms after the previous one. The first byte of each message is the ID of the next module in the ring, without the 0x5 at the start. The IDs go up in order, so if you have three modules, the sleep wake messages might be like this:-

0x525 33 12
0x533 37 12
0x537 25 02

with 100 ms between each message. That pattern would repeat as long as the car is awake. Obviously the other messages would be happening at the same time.

The 2nd byte has a 1 in the first nibble when the module is ready to sleep, and a 0 when it needs the CANbus to be awake. So in this case the module transmitting 0x537 needs the CANbus awake. The 2nd nibble of the 2nd byte is 1 when the module is working, and 2 when the ring is stable. As the car wakes up, the different modules work out the order of the ring, and it's a bit chaotic for a couple of seconds, but if they all follow the rules, it all sorts itself out in a few seconds.

The message you logged, of 0x503 03 04 00 means that the module can't find any to form a ring with, so the next one in the ring itself, and the 04 means there is a problem. When it transmits 0x503 03 14 00, that means it is about to go to sleep.

If you just transmit:-
0x501 03 02 00
every 200 ms, the module will stay awake. It will transmit
0x503 01 12 00
every 200 ms, each time about 100 ms after the 0x501 message.

When you want the module to go to sleep, you can just stop transmitting, or you can send:-
0x501 03 12 00
100 ms after that, the module will transmit
0x503 01 32 00
and will then fall silent and go to sleep. The 32 means that the bus is asleep, and there will be no more messages in the 0x500 - 0x57F range.

I think that once you get the module to stay awake, it will make working out the other signals a lot easier.

 

[Diver300]

I've just realised that there's a simpler way of getting that module to stay awake. As well as the 0x503 message with its complicated systems for keeping awake, your module also transmitted an 0x583 message.

The messages in the 0x580 - 0x5FF range also keep the modules awake but they work to a newer system that is far simpler.

Any module that wishes to keep the network awake transmits a message in the 0x580 - 0x5FF range every 200 ms
Any module that doesn't see a message in the 0x580 - 0x5FF range for more than 200 ms can go to sleep.

The only disadvantage of that system is that there isn't a definitive message saying the CANbus is asleep, so all the module go to sleep at sligtly different times. With the ring system, they all stop within a few ms of the sleep message.

All you therefore need to do is to send a message in the 0x580 - 0x5FF range (but not 0x583) with any content, once every 200 ms and the module will stay awake. Cease sending it and the module will sleep.

Please tell us how you get on.

 

[pyrocrazy130]

Diver300 Thank you so much for your thorough reply. It answered a lot questions and created even more.

I was looking for a much, much longer log showing wake-up on the CANbus. Your burst of 10 messages lasts just 35 ms.

I posted the raw candump files on my github: here

What I would like to see is a log of the car waking up that lasts about 5 seconds, but only of messages in the 0x500 - 0x57F range.

I am currently using socketcan to dump the CAN data, is there a way I can tell socketcan to only log a range of IDs? I am still very new to Linux and socketcan.

All you therefore need to do is to send a message in the 0x580 - 0x5FF range (but not 0x583) with any content, once every 200 ms and the module will stay awake. Cease sending it and the module will sleep.

I think I may build a module with arduino to do just that. I'll post my progress with this in a different thread.

Please tell us how you get on.

I certainly will, I will post some videos as well. Thank you again for your insight.

 

[Diver300]

Your logs created more questions from me as well. Thank you for sending them.

I have no idea how to use socketcan. Your post was the first time that I had heard of it.

I have extracted the CAN IDs that are in the 0x500 - 0x57F range and they are in the attached file, along with the first and 2nd bytes. They are not doing what I would have expected, but there are lots of features of their behaviour that make me think that those messages are, as I said before, involved in keeping the modules awake.

The CAN IDs in the range 0x500 - 0x57F are doing some of the things that I expected, such as:-
1) The 1st byte is sometimes their own CAN ID without the 0x5
2) The 2nd byte is sometimes another CAN ID from the 0x500 - 0x57F range that has been seen recently, without the 0x5
3) When a message is transmitted with the first byte an ID, the module with that ID will often transmit its own message about 100 ms later
4) When 3) happens, the second byte is often 12, indicating a stable ring.

There seem to be modules sending frames with IDs of
0x501
0x503
0x50C
0x527
0x53B
0x541

However the ring never achieves stability.

I can't see why any module would transmit more than one ID in the range 0x500 - 0x57F, so the logs imply 6 or more modules on the bus.

I suspect that the car isn't using the network messages to keep awake, because it isn't working. It is entirely possible that the modules are disconnected from the battery on that car after the ignition is turned off, so it may not matter.

There are a few messages in the 0x580 - 0x5FF range which may be some modules using the more modern system to say they want the bus to stay awake.

 

[pyrocrazy130]

I've been having problems with my current hardware setup on the pi and i just received some new stuff. I was able to build a module that will transmit a message at a defined frequency. I tried out some of your suggestions. I setup a network on the bench with only my sniffer, injector and the ford HVAC module. Here are some results:
Quote:

If you just transmit:-
0x501 03 02 00
every 200 ms, the module will stay awake. It will transmit
0x503 01 12 00
every 200 ms, each time about 100 ms after the 0x501 message.

Result

(1591846395.029073) can0 501#030200
(1591846395.113173) can0 503#011200
(1591846395.229763) can0 501#030200
(1591846395.314779) can0 503#011200
(1591846395.430482) can0 501#030200
(1591846395.466267) can0 124#0202000000000000
(1591846395.467263) can0 35E#8000000000000000
(1591846395.468276) can0 3E7#0000000000000000
(1591846395.469248) can0 41A#00006460A2067590
(1591846395.516352) can0 503#011200
(1591846395.631211) can0 501#030200
(1591846395.717919) can0 503#011200
(1591846395.831935) can0 501#030200
(1591846395.919543) can0 503#011200
(1591846396.032659) can0 501#030200
(1591846396.121143) can0 503#011200
(1591846396.233384) can0 501#030200
(1591846396.322727) can0 503#011200
(1591846396.434118) can0 501#030200
(1591846396.474261) can0 124#0202000000000000
(1591846396.475243) can0 35E#8000000000000000
(1591846396.476260) can0 3E7#0000000000000000
(1591846396.477228) can0 41A#00006460A2067590
(1591846396.524330) can0 503#011200
(1591846396.634825) can0 501#030200
(1591846396.725903) can0 503#011200
(1591846396.835541) can0 501#030200
(1591846396.927510) can0 503#011200
(1591846397.036252) can0 501#030200
(1591846397.129108) can0 503#011200
(1591846397.236999) can0 501#030200
(1591846397.330713) can0 503#011200
(1591846397.437709) can0 501#030200
(1591846397.482234) can0 124#0202000000000000
(1591846397.483221) can0 35E#8000000000000000
(1591846397.484245) can0 3E7#0000000000000000
(1591846397.485213) can0 41A#00006460A2067590
(1591846397.532308) can0 503#011200
(1591846397.638445) can0 501#030200
(1591846397.733913) can0 503#011200
(1591846397.839164) can0 501#030200
(1591846397.935515) can0 503#011200
(1591846398.039878) can0 501#030200
(1591846398.137100) can0 503#011200
(1591846398.240562) can0 501#030200
(1591846398.338696) can0 503#011200
(1591846398.441300) can0 501#030200
(1591846398.490202) can0 124#0202000000000000
(1591846398.491189) can0 35E#8000000000000000
(1591846398.492214) can0 3E7#0000000000000000
(1591846398.493222) can0 41A#00006460A2067590
(1591846398.540313) can0 503#011200
(1591846398.642059) can0 501#030200
(1591846398.741907) can0 503#011200
(1591846398.842765) can0 501#030200
(1591846398.943498) can0 503#011200
(1591846399.043470) can0 501#030200
(1591846399.124892) can0 503#011200
(1591846399.244210) can0 501#030200
(1591846399.326521) can0 503#011200
(1591846399.444927) can0 501#030200
(1591846399.498199) can0 124#0202000000000000
(1591846399.499209) can0 35E#8000000000000000
(1591846399.500196) can0 3E7#0000000000000000
(1591846399.501168) can0 41A#00006460A2067590
(1591846399.528072) can0 503#011200
(1591846399.645617) can0 501#030200
(1591846399.729680) can0 503#011200
(1591846399.846347) can0 501#030200
(1591846399.931269) can0 503#011200
(1591846400.047069) can0 501#030200
(1591846400.132870) can0 503#011200
(1591846400.247788) can0 501#030200
(1591846400.334465) can0 503#011200
(1591846400.448496) can0 501#030200
(1591846400.506150) can0 124#0202000000000000
(1591846400.507153) can0 35E#8000000000000000
(1591846400.508184) can0 3E7#0000000000000000
(1591846400.509155) can0 41A#00006460A2067590
(1591846400.536078) can0 503#011200
(1591846400.649218) can0 501#030200
(1591846400.737665) can0 503#011200
(1591846400.849938) can0 501#030200
(1591846400.939244) can0 503#011200
(1591846401.050659) can0 501#030200
(1591846401.140850) can0 503#011200
(1591846401.251379) can0 501#030200
(1591846401.342438) can0 503#011200
(1591846401.452105) can0 501#030200
(1591846401.514124) can0 124#0202000000000000
(1591846401.515142) can0 35E#8000000000000000
(1591846401.516184) can0 3E7#0000000000000000
(1591846401.517123) can0 41A#00006460A2067590
(1591846401.544037) can0 503#011200
(1591846401.652820) can0 501#030200
(1591846401.745651) can0 503#011200
(1591846401.853548) can0 501#030200
(1591846401.947230) can0 503#011200
(1591846402.054259) can0 501#030200
(1591846402.148826) can0 503#011200
(1591846402.254981) can0 501#030200
(1591846402.350422) can0 503#011200
(1591846402.455700) can0 501#030200
(1591846402.522125) can0 124#0202000000000000
(1591846402.523111) can0 35E#8000000000000000
(1591846402.524141) can0 3E7#0000000000000000
(1591846402.525122) can0 41A#00006460A2067590
(1591846402.552070) can0 503#011200

Quote:

Any module that wishes to keep the network awake transmits a message in the 0x580 - 0x5FF range every 200 ms

Result

(1591847988.625182) can0 503#030200
(1591847988.754344) can0 580#030100
(1591847988.887226) can0 503#030100
(1591847988.955056) can0 580#030100
(1591847988.988032) can0 503#030200
(1591847989.155786) can0 580#030100
(1591847989.250121) can0 503#030100
(1591847989.350920) can0 503#030200
(1591847989.356442) can0 580#030100
(1591847989.421772) can0 124#0202000000000000
(1591847989.422772) can0 35E#8000000000000000
(1591847989.423831) can0 3E7#0000000000000000
(1591847989.424786) can0 41A#00006460A2067590
(1591847989.557205) can0 580#030100
(1591847989.612984) can0 503#030100
(1591847989.757916) can0 580#030100
(1591847989.958655) can0 580#030100
(1591847990.159369) can0 580#030100
(1591847990.360078) can0 580#030100
(1591847990.429797) can0 124#0202000000000000
(1591847990.430782) can0 35E#8000000000000000
(1591847990.431798) can0 3E7#0000000000000000
(1591847990.432759) can0 41A#00006460A2067590
(1591847990.560776) can0 580#030100
(1591847990.620962) can0 503#030400
(1591847990.761493) can0 580#030100
(1591847990.962207) can0 580#030100
(1591847991.162932) can0 580#030100
(1591847991.363642) can0 580#030100
(1591847991.437731) can0 124#0202000000000000
(1591847991.438731) can0 35E#8000000000000000
(1591847991.439765) can0 3E7#0000000000000000
(1591847991.440731) can0 41A#00006460A2067590
(1591847991.564366) can0 580#030100
(1591847991.628991) can0 503#030400
(1591847991.765089) can0 580#030100
(1591847991.965842) can0 580#030100
(1591847992.166529) can0 580#030100
(1591847992.367255) can0 580#030100
(1591847992.445704) can0 124#0202000000000000
(1591847992.446705) can0 35E#8000000000000000
(1591847992.447735) can0 3E7#0000000000000000
(1591847992.448703) can0 41A#00006460A2067590
(1591847992.567972) can0 580#030100
(1591847992.636918) can0 503#030400
(1591847992.768690) can0 580#030100
(1591847992.969432) can0 580#030100
(1591847993.170133) can0 580#030100
(1591847993.370858) can0 580#030100
(1591847993.453691) can0 124#0202000000000000
(1591847993.454692) can0 35E#8000000000000000
(1591847993.455722) can0 3E7#0000000000000000
(1591847993.456690) can0 41A#00006460A2067590
(1591847993.571566) can0 580#030100
(1591847993.644890) can0 503#031400
(1591847993.772288) can0 580#030100
(1591847993.973031) can0 580#030100
(1591847994.173765) can0 580#030100
(1591847994.374463) can0 580#030100
(1591847994.575192) can0 580#030100
(1591847994.775916) can0 580#030100
(1591847994.976637) can0 580#030100
(1591847995.177332) can0 580#030100
(1591847995.378085) can0 580#030100
(1591847995.578796) can0 580#030100
(1591847995.580238) can0 503#030100
(1591847995.680950) can0 503#030200
(1591847995.779497) can0 580#030100
(1591847995.832511) can0 124#0202000000000000
(1591847995.833510) can0 35E#8000000000000000
(1591847995.834543) can0 3E7#0000000000000000
(1591847995.835510) can0 41A#00006460A2067590
(1591847995.943090) can0 503#030100
(1591847995.980238) can0 580#030100
(1591847996.043881) can0 503#030200
(1591847996.180959) can0 580#030100
(1591847996.305952) can0 503#030100
(1591847996.381702) can0 580#030100
(1591847996.406751) can0 503#030200
(1591847996.582423) can0 580#030100
(1591847996.668820) can0 503#030100
(1591847996.769632) can0 503#030200
(1591847996.783150) can0 580#030100
(1591847996.840533) can0 124#0202000000000000
(1591847996.841489) can0 35E#8000000000000000
(1591847996.842517) can0 3E7#0000000000000000
(1591847996.843484) can0 41A#00006460A2067590
(1591847996.983881) can0 580#030100
(1591847997.031698) can0 503#030100
(1591847997.184562) can0 580#030100
(1591847997.385320) can0 580#030100
(1591847997.586041) can0 580#030100
(1591847997.786766) can0 580#030100
(1591847997.848476) can0 124#0202000000000000
(1591847997.849503) can0 35E#8000000000000000
(1591847997.850504) can0 3E7#0000000000000000
(1591847997.851473) can0 41A#00006460A2067590

The 0x501 messages keeps the illumination of the HVAC module on and steady. The 0x580 messages will wake the module and flash the illumination. It seems if you give the module any message it will yield the same result as the 0x580 message. Neither of these allows the HVAC controls to work but I'm going to keep working at it now that I have hardware that can transmit reliably.

 

[Diver300]

It seems that the 0x501 message is keeping the module awake. It is sending the 0x503 message as I predicted which means that it is understanding the 0x501 message and including the "01" from the 0x501 in the first byte of it's reply.

I had been mistaken when I thought that the 0x583 message came from the same module, so I suggest that you forget about the 0x580 message. Your module is not keeping awake with the 0x580 message.

With the 0x501 message keeping the module awake, each second it is transmitting the four operational messages, with IDs of 0x124, 0x35E, 0x3E7 and 0x41A, so I think that it is working.

When you say "Neither of these allows the HVAC controls to work", I don't know what you are expecting. In my limited experience of this, the HVAC control panel sends a request to the HVAC to raise or lower a setting, but the HVAC control panel displays what the HVAC asks it to display. In my experience there is nothing in the HVAC control panel to make the knobs have any effect on what the display shows. That is done from the rest of the car.The HVAC control panel acts a bit like a keyboard and screen on a computer.

My first experience with CAN was with an HVAC controller. I had to get it to illuminate away from a car so we could see what it looked like. Someone suggested that I record the entire CANbus traffic from a car that had one of that type of HVAC controllers. I recorded for 30 s or so and I played that back on a repeating loop. That worked fine and the HVAC control illuminated as though it was on a car. I was using a PC and a Vector CANalyser for that.

The suggestion was also to operate the HVAC controls on the car while recording from the car, so that during playback the numbers on the display would go up and down to make the display more interesting. That also worked, and it proved that the HVAC control was just a display / control knob unit. The actual HVAC settings are stored elsewhere.

I suggest that you keep the module awake with the 0x501 message, and then look at the CAN signals when you operate the controls. I think you will find that the operation messages will change, and appear more often when you operate the controls.

 

[pyrocrazy130]

We have some progress! I was able to find the message that will allow control of the HVAC module... Sorry for the confusion, i will try to be more detailed. When i was describing the illumination I was referring to just the back lights for the buttons on the module. At first I thought the 0x5xx messages may have been just the brightness levels for the interior lighting of the vehicle but, with your insight, i see that these messages are much more complicated.

A friend of mine asked if i could help him with adding a Ford Trailer Brake Controller to his 2016 F150. It did not have one at the time of purchase. He had installed the controller but the truck would not recognize the new module. I had heard of Forscan before but I never used it because my vehicles were too old to take advantage of what it can do. We were successful in adding the module and now he has Ford Factory Trailer Brakes on his truck.(Ford dealer wanted his truck ALL DAY and wanted $150) Now that I am trying to add new equipment to an old truck, Forscan may become more useful. After we added the TBC module, i realized Forscan had some DTC information that was not causing a MIL status.

We found that a wire was nicked near the grille of his truck. We repaired it and all was well.

I bring this up because i was thinking maybe the 0x5xx messages are some kind of checksum or error reporting to a higher level. The reason i think this is because i found the message that will allow the HVAC module to wake up and turn on the "keyboard" functions of the module. The message is 0x3A0 [8] 45 00 80 02 89 24 00 00 played at 200ms. The 0x501 message was not needed to get this result: Youtube Video.

Since i was able to get the HVAC module to work, i identified the message sent to the Dual Climate Controlled Seat Module (DCSM) to activate the TED (peltier) chips in the new seats. This is what i wanted to accomplish in the first place but this was achieved without the 0x501 message. Whats most interesting though, i have since added the DCSM to the bench network and recorded a candump of the 2 modules reacting to the 0x501 message you had suggested before: CANdump

I would like to hear what you think. I am probably way off base.