CAN Bus – Exploring Other Worlds (MS-CAN)

In a previous post, I explored the CAN bus on Pins 6 & 14 of my OBD port to hunt down the door status message. During that exercise I figured out how the door status message works. After that I spoofed the door status message in an effort to make my Instrument Panel Cluster (IPC) display door ajar when the doors were actually closed and vice versa. I was ultimately unsuccessful. When attempting to determine the reason why, I came to the conclusion that my IPC was not on the same bus as the one that my USB2CAN device was connected to. Consequently, any attempt to influence the behavior of the IPC was ultimately futile. With some research, I found that the IPC was ultimately on the MS-CAN bus. According to the documentation on the Ford OpenXC site and the Ford Focus ST Forum site the bus on Pins 6 & 14 is referred to as CAN1 or HS-CAN. Using that information and looking at my OBD port, I was able to determine that there exists two other buses available via my OBD port which are CAN2-1 or MS-CAN on Pins 3 & 11 and CAN2-2 or I-CAN on Pins 1 & 8. The Ford Focus ST Forum site had some topology diagrams which were very helpful in determining that my IPC was in fact on the MS-CAN bus.

My suspicion was that a separate door status message existed that was being transmitted by the Body Control Module (BCM) onto the MS-CAN bus. According to Pinoutguide.com this bus communicates at 125Kbit/s. My USB2CAN device is capable of 125 kbit/s, but it only has CAN on Pins 6 & 14 and this posed a problem. I needed a way to map Pins 6 & 14 on my device to 3 & 11 on the OBD port. The chart below lists the required mapping:

The materials I used to build the MS-CAN adapter harness were some wire, a J1962M Connector, J1962M Terminal Pins, a J1962F Connector, and J1962F Terminal Pins. These materials can all be bought for around $10. After assembling with the aid of wire strippers and a crimping tool, this little harness opened up an entirely new interface of the vehicle for exploration.

Following assembly, I connected my USB2CAN device to my laptop and then set the bitrate to 125 kbit/s by entering the following into my terminal:

sudo ip link set can0 type can bitrate 125000
sudo ip link set up can0

Next, I used the “MS-CAN” harness adapter as the middleman between the USB2CAN device and the vehicle J1962 connector.

Finally, I fired up cansniffer to see if the MS-CAN bus traffic was visible to the tool. Success! Houston, we have access to the MS-CAN bus on this vehicle!

This article showcased a simple way to access additional CAN networks by fabricating a simple adapter harness for just a few bucks. Next time, I will see if I can hunt down and spoof the door status message on the MS-CAN bus. Thanks as always for reading and I hope this article was helpful.