So today I managed to spend some time on the MS-
CAN bus. I learned quite a lot today too - about how J2534 devices (USB devices that plug into the OBD2 port) can actually manually change which pins they talk on, and that they can establish multiple concurrent sessions on up to 4 different buses.
The HSCAN bus presents on two standard pins on the DLC OBD2 port under the steering wheel - CAN High line is on pin6, and CAN Low on pin14. This HSCAN bus is a 500kbps 11bit CAN protocol. The MSCAN bus presents on the pins that used to be used for the Ford PWM protocol - which I think was used on the EA and onwards and perhaps the AU falcon. It presents on pin 3 for the CAN-H and pin 11 for the CAN-L. The MS-
CAN bus is also an 11bit addressed bus, but it runs at 125kbps.
In the XR4 Fiesta, the modules on the HSCAN bus are:
ABS,
PCM, Instrument Cluster and two modules used by the European robotic manual IB5 transmission. The workshop manual also says that the Electro Hydraulic Power Steering from the LS Focus is on this bus too - so like Cruise Control it looks like this was in development for the CBK Fiesta/Fusion but never made it to production before development of CB1 started.
The modules on the MSCAN bus are: Instrument Cluster (This is the bridge between the two CAN buses), Restraints Module, EATC - auto climate control, Audio Module, Blue Tooth/Voice Recognition Module (Europe Only), GEM body control module.
There's also a 1-wire ISO9141 bus that still seems to be used, with the Restraint and
ABS module still doing some things on that bus.
Now, for the MSCAN stuff, there seems to be an absolute shyte load of messages on this one. Some of them are the same as those on the HSCAN bus, and must pass through the instrument cluster to get there. Most are unique to the MSCAN bus. There appear to be quite a few more broadcast messages on the MSCAN bus than are on the HSCAN bus.
The full list of messages and their header addresses is as follows. I have yet to attempt to map anything out. For many of these I found bits changing when I pressed buttons on the Audio module, and I think I've found the messages that send the 8 characters of text to the instrument cluster, so that's looking pretty good now.
023, 080, 201, 210, 265, 285, 286, 2A5, 2D5, 2D8, 2D9, 2DA, 2DB, 2DC, 2E3, 2F4, 360, 410, 420, 428, 433, 460, 499, 4C0, 4D0, 4D7, 4F2, 4F3, 501, 50C, 511
Luke