More CAN bus fun!
.
Since my end goal is to do away with the Ford PCM altogether, I have a lot of work to do to figure out how to reproduce the CAN packets that the PCM sends to various modules. One of the most important things to figure out is how vehicle speed is transmitted over the bus because several modules use that particular packet. Online I found a technical paper about hacking a Ford CAN bus and it gave some clues as to which identifier speed and RPM use as well as some conversion equations to get from hexadecimal format to something understandable.
.
The easiest way to test out the theory is to broadcast a packet on the bus and see what happens... And what do you know??? I have an extra instrument panel cluster, a power supply and a homemade harness for just such an occasion.
.
From the tech paper online:
"The data format is:
[AA BB 00 00 CC DD 00 00]
.
Where AABB - is the rpm displayed and CCDD is the speed.
.
To get from the bytes in the CAN packet to the actual speed, the following formulas can be used:
Speed (mph) = 0.0065 * (CC DD) - 67
RPM = .25 * (AA BB) - 24"
.
So, according to this, if I plug in some numbers and send the packet with the right identifier to the IPC, the RPM and speed will display on the gauges.
.
Using their example, I plugged in [23 45 00 00 34 56 00 00] and here is what happened...
.
.
It works!!! I was able to change the values and manipulate the two gauges no problem. One identifier down, 100+ to go! haha!
.
That isn't much of a breakthrough but at least I was able to narrow down 4 other packet identifiers originating from the IPC.