Ford Five Hundred OBD-II: Part 1

The OBD-II port in modern vehicles allows the user to access the internal network of the vehicle's modules and sensors. This port exposes a variety of networks, such as CAN (Controller Area Network), SAE J1850 PWM, ISO 14230-4 KWP, or other proprietary ones.

CAN Bus

In my 2005 Ford Five Hundred, there are two CAN bus networks, High-Speed (HS) and Low-Speed (MS) CAN. The HS-CAN network carries all "priority" messages, and has the critical/safety modules attached to it.

These networks can be accessed by using an ELM327-compatible IC and software on a computer. The SparkFun OBD-II UART adapter works great (use with their OBD-II to DB9 Cable), and has headers for more custom implementations. I made my own OBD-II to DB9 cable with a DPST switch to change between HS-CAN and MS-CAN networks, which comes in handy when using FORScan.

There are a variety of ELM327-compatible OBD-II computer applications. I used the free FORScan application for most of the "reverse-engineering" of the MS-CAN network. This is far from ideal, however, since FORScan is closed source. I set up an old Dell Inspiron notebook with Windows XP, which was used to run FORScan and Sysinternal's Portmon. This setup allowed me to see what commands and messages were being exchanged between the vehicle, the ELM327 adapter, and FORScan. There are other applications out there, but I've yet to come across a free software that "knows" as much as FORScan does about my vehicle. I believe I had to tell FORScan that my car was a 2006 model, for the MS-CAN network to be recognized.

HS-CAN

This is an ISO 15765-4 compliant CAN network, operating at 500 kbaud, with 11-bit messages. ELM327 protocol 6.

The following modules are attached to this network:

• IC - Instrument Cluster (this also acts as a gateway between the HS and MS CAN networks)
• *List incomplete

MS-CAN

This CAN network operates at 125 kbaud, with 11-bit messages. ELM327 protocol "B" (Note: this is the default setting of the user-configurable protocol slot). This is the more interesting network, as it allows access to the various "comfort" modules in the car. The following modules are attached to this network:

• IC_MSCAN - Instrument Cluster
• ACM - Audio Control Module
• GEM - General Electronic Module (Lights, locks, etc.)
• EATC - Electronic Automatic Temperature Control
• *List incomplete

OBD-II Port Pinout/Wiring

Pinout

(* NC = Not Connected)

Wiring Colours

Modules

Audio Control Module

This module can be polled to see which steering wheel buttons are being pressed. These buttons are not directly connected to the MS CAN network, therefore no messages are broadcasted when buttons are pressed. The wiring diagram of the connection to the factory radio is documented here.