Hacking a Ford OEM navigation HU

**sredmyer** · 03-06-2011, 09:50 AM

I am working on the factory OEM navigation system from Ford. This is the 2009-2011 unit manufactured by Clarion. All I am trying to do at this point is to simulate the required CAN BUS signals so that the unit can be powered up on the bench. Although I have so far done a considerable amount of reading I do not yet have a clear idea of what I need or how I would do this.

As mentioned previously these units are manufactured by Clarion for Ford. They are available in many Ford vehicles with various different features and controls. For instance when installed in a Ford Edge they may be configured to provide (via MS-CAN signals) control over the climate control system of the vehicle while the same unit installed in a Super Duty truck would not be configured for this option. The point is that the units have a large number of configuration settings that determine what user features and graphical elements are actually present. Ford has these devices locked down so that they can only be programmed (have the aforementioned configurations set) by an authorized Ford service center using a proprietary tool built by Ford. Currently there are only two companies in the USA that are authorized by Ford to do this.

Further these unit have a built in hard drive which stores the nav software and all of these configuration values and other device required files. This hard drive is a 40gb drive of which 10gb is available for the user to store pictures and media files. The only way for the user to get media files on the device is to load a CD and instruct the unit to rip it. The unit has a built in Gracenote metadata database that it uses to lookup the CD and tag the files so that the user interface can display the album art, track titles and the like when the user selects the internal jukebox as the media source. This is a neat feature but is virtually useless since there is no way to mass load media files. The only way to load the jukebox is to rip each CD individually into the unit. At approximately 6 minutes per CD a person could spend an entire weekend just loading a few CDs.

As I say all I am trying to do at this point is to "spoof" the required CAN signals to get this thing to power up on the bench. However eventually I would like to figure out how to manipulate the configuration values and find a way to mass load media files. Problem is I have no idea where to even start with this project. I am not exactly ignorant on electronics but it certainly is not my area of expertise. I am a software engineer who has worked in the corporate environment for many years. I mention this only to point out that I am experienced writing Windows desktop and client server applications using VB (both classic and .Net) and C# but have very little knowledge of embedded programming.

Can anyone here provide me with any direction as to how to get started on this project?

Thanks,
Steve

**StevePER** · 03-06-2011, 05:30 PM

I guess you need to power it up in the vehicle and listen on the CAN bus to try to work out what messages are required. Do you have any physical access to the MS-CAN bus in the vehicle? (On my Mazda 3 it is available through the OBD-2 connector). In my car the pins used for MS-CAN are not the standard CAN pins so I couldn't use a commercial OBD-2 tool. The cheapest way I could find to listen to the CAN bus is with a Microchip CAN Bus Monitor Demo Board. The provided software is enough to listen to the messages.

You can also use the provided software to send messages, but if it's more than one message you'll probably want to write your own PC software to do this. The protocol is not too hard to work out, and I have already done this. The challenge is writing USB software in general - I used libusb under Linux and there is a Windows port so perhaps it wouldn't be too hard? But this depends on your coding skills.

**sredmyer** · 03-06-2011, 09:49 PM

Originally Posted by StevePER

I guess you need to power it up in the vehicle and listen on the CAN bus to try to work out what messages are required. Do you have any physical access to the MS-CAN bus in the vehicle? (On my Mazda 3 it is available through the OBD-2 connector). In my car the pins used for MS-CAN are not the standard CAN pins so I couldn't use a commercial OBD-2 tool. The cheapest way I could find to listen to the CAN bus is with a Microchip CAN Bus Monitor Demo Board. The provided software is enough to listen to the messages.

I can access the MS-CAN on pins 3 (high) and 11 (low) of the OBDII port. Are those the standard pins or will I also need to use a alternate solution as you did? From my reading I had been under the impression that even though the pins were available there standard OBDII scan tools were not designed to read MS-CAN...they were designed for diagnosis of critical vehicle system (ie. PCM) and therefore only monitored the HS-CAN bus. Having said all of that, I can fairly easily get to the MS-CAN wires at the navigation system harness.

I had a look at the web site for that device. It certainly does look interesting but as I look through the documentation I keep wondering how I will ever figure out what the thing is telling me. It seems as though the data will be a stream of hex numbers which, without knowing at least where a particular message starts and ends, will be virtually impossible to decipher...kinda like sitting in a room full of people speaking a foreign language...I would have no idea what was being discussed. Further it looks like there are some parameters which need to be set for the communication to make any sense even to someone who knew what to look for (kinda like setting the baud rate for serial communication). Since I have no idea what the data should look like, how would I know when I got the parameters correct...results would look like giberish to me regardless.

Any insight you can give me on this would be greatly appriceated.

Originally Posted by StevePER

You can also use the provided software to send messages, but if it's more than one message you'll probably want to write your own PC software to do this. The protocol is not too hard to work out, and I have already done this. The challenge is writing USB software in general - I used libusb under Linux and there is a Windows port so perhaps it wouldn't be too hard? But this depends on your coding skills.

Once I understand what I am dealing with writing the software to read/write to a USB device is not that tough (there are libraries for it). Having said that, doesn't the device simply create a virtual COM port on USB. If that is the case communicating with it is even easier.

Thanks,
Steve

**StevePER** · 03-06-2011, 11:17 PM

Originally Posted by sredmyer

I can access the MS-CAN on pins 3 (high) and 11 (low) of the OBDII port. Are those the standard pins or will I also need to use a alternate solution as you did? From my reading I had been under the impression that even though the pins were available there standard OBDII scan tools were not designed to read MS-CAN...they were designed for diagnosis of critical vehicle system (ie. PCM) and therefore only monitored the HS-CAN bus. Having said all of that, I can fairly easily get to the MS-CAN wires at the navigation system harness.

OK, your car is like mine with the HS-CAN on the standard pins and the MS-CAN inaccessible to the OBDII tools. I have found for testing purposes I can just jam some wires in to the right pins and it works.

I had a look at the web site for that device. It certainly does look interesting but as I look through the documentation I keep wondering how I will ever figure out what the thing is telling me. It seems as though the data will be a stream of hex numbers which, without knowing at least where a particular message starts and ends, will be virtually impossible to decipher...kinda like sitting in a room full of people speaking a foreign language...I would have no idea what was being discussed. Further it looks like there are some parameters which need to be set for the communication to make any sense even to someone who knew what to look for (kinda like setting the baud rate for serial communication). Since I have no idea what the data should look like, how would I know when I got the parameters correct...results would look like giberish to me regardless.

The data is indeed a stream of hex numbers. For each message, you get a message ID, data length and data (up to 8 bytes). If it's the standard CAN protocol it isn't difficult to tell where messages start and end, but some manufacturers put other protocols on top of CAN to make it more difficult (eg use protocols that wrap logical messages over multiple CAN messages). The parameters are easy, they will just be using one of the standard speeds (probably 125 kbit) and you can just keep trying different speeds until you find one that works. When it doesn't work, you immediately get lots of errors so it's obvious.

But you still need to work out what the messages mean, or at least which messages are required to achieve your objective. I was lucky that someone had reverse engineered the Mazda 3 CAN bus. If you're lucky someone will have done the Ford stuff before you. Otherwise you could write some software to record everything off the CAN bus when you turn the HU on, then play it back on the bench.

Once I understand what I am dealing with writing the software to read/write to a USB device is not that tough (there are libraries for it). Having said that, doesn't the device simply create a virtual COM port on USB. If that is the case communicating with it is even easier.

Unfortunately this device doesn't create a virtual COM port (but the more expensive USB-CAN adapters do).

**syncit** · 02-02-2012, 09:17 AM

Originally Posted by sredmyer

I am working on the factory OEM navigation system from Ford. This is the 2009-2011 unit manufactured by Clarion. All I am trying to do at this point is to simulate the required CAN BUS signals so that the unit can be powered up on the bench.

I am looking to do exactly the same thing, anyone have any success in this area?

**sredmyer** · 02-02-2012, 05:13 PM

Originally Posted by syncit

I am looking to do exactly the same thing, anyone have any success in this area?

You have a PM

**pdanders** · 03-10-2013, 10:25 PM

Sorry to bump an old thread but I'm looking to get a ford system NAVI based systems to power up on the bench. Looking for ways to capture and generate the MS-CAN signals.

**Zeroaviation** · 03-12-2013, 03:18 PM

I'm in the same boat as pdanders. I also want to control the A/C, etc.

Any insight on this would be greatly appreciated, PM's welcome!

**heavymetals** · 03-13-2013, 07:37 PM

I asked the same thing about a canbus library.

It looks like you have to get a canbus sampler and create your own.

I got this one:

http://www.microchip.com/stellent/id...cName=en546534

**pdanders** · 03-17-2013, 07:16 AM

Ok, thanks. I'm getting canbus analyzer and will go from there.

Not where to post this but I'll start here. I want to be able to put video on my Ford Nav display but I want to use the LVDS interface and not the composite video due to quality reason. Digging, reading, and some circuit review, I think ford takes there video from their main radio/nav/sync module translates it to LVDS and send it to the display over a 4 pin quad coax cable.

The chips seem to be these that take the parallel data and converts it to LVDS and back. Ideally, I would like to figure out a HDMI to the "V-by-one" convertor but I'm stuck at the moment understanding the encoders parallel bus. If I can get the video to LVDS, I assume a high speed mux could swap the inputs.

http://www.thine.co.jp/products_e/V-by-One/

So far I have found only one device the can input video on the LVDS cable and it takes RGB in. Everyone else uses the video input. If anyone has looked into this please let me know.