Ford Mondeo CAN bus hacking

After building the CAN sniffer with Elduino CAN128 board I wanted to see CAN messages in my old Ford Mondeo.Ford Mondeo MK3 CAN hacking

After connecting the board to OBD2 connector and turning on the ignition I started seeing quite a few packets. This is a very good sign - it shows that the board is connected properly, CAN baud rate is correct and that the Arduino software works.

However, I have made a mistake when defining/passing the variable for message count, thus some of the counts show negative values. At the moment I am more interested in CAN message id's and data. At the beginning it looks like a lot of random numbers that make no sence. However, trying to play around with knobs, pedals and buttons makes the image a lot more clear. First of all I wanted to figure out if there is a message containing gas pedal position. This is the easiest data to spot - just pres/release the pedal and look for changing numbers in the screen. After pressing the pedal I saw that bytes D6-D7 change in the packet with ID 0x201. I saw that the value range is between 0x0000 and 0xc800, D6 is a high byte and D7 is low. Doing the same thing with all other inputs I have figured out the steering wheel position data, hand brake status an more:

  

CAN ID D0 D1 D2 D3 D4 D5 D6 D7 Comments
0x80  SWH  SWL            

SteeringPositionSensor

SW - steering wheel position in 0.1 degrees (90 degrees = 900)

0x201 RPMH RPML     SPEED   GASH GASL

RPM - engine RPM multiplied by 4 (4000=1000RPM)


GAS - gas pedal position (range 0- 0xc800)


SPEED - divided by 2 (50 =100km/h)

0x440 AC?              

AC control module

AC? = 0x80 when AC is on (bit 7 - AC state)

0x430             HB?   HB? = 0x20 when hand brake is on (bit 5 - hand brake state)

Here is the screenshot of serial terminal with registered CAN messages

sniffed Ford Mondeo MK3 CAN bus messages

Comments

Comment: 
Hi, Thanks for your very good information. Please i have my own project if possible to help me. I make control with an android application and Arduino 2560 Mega with transfer a string message from android to bluetooth module which is connected to ardino then i received message. Now i want to interface this message with lin bus MCP2004 with and RGB module APGRD004 which recive a sting message to display a selected color from android application. my email is : mostafa_ezzeldeen@yahoo.com.   Thanks alot.
By Mostafa (not verified)

Add new comment

Filtered HTML

  • Web page addresses and e-mail addresses turn into links automatically.
  • Allowed HTML tags: <a> <em> <strong> <cite> <blockquote> <code> <ul> <ol> <li> <dl> <dt> <dd>
  • Lines and paragraphs break automatically.

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
CAPTCHA
This question is for testing whether or not you are a human visitor and to prevent automated spam submissions.
Please prove you are not a robot:
Question text provided by textcaptcha.com