Apologies if this is the wrong forum, browsing the desktop view on mobile.

I'm curious if anybody has hooked up a canbus sniffer and determined what signal is being sent to the APIM when you select the Front Camera button on Sync3.

From what I've seen on other threads, the FCIM signals the IPMB, which then signals the APIM. My car was only equipped with a rear camera, so I do not have an IPMB, nor do I feel like spending hundreds of dollars on modules to MAYBE find a usable code.

I've gotten as far as finding the typical "fcim to apim" signals for button presses and can change volume / tracks / etc through the diagnostic port. Even found a Mute function I've never seen before. But the 'front camera view' is one that I just cannot locate without an IPMB to watch. I already have a front camera installed and can view it by putting the car in reverse first (using a relay to do the signal switching the IPMB normally handles), but I'm sure there's a different signal the IPMB sends when you press the Front Camera button.

I've already enabled the Front Camera setting in forscan, just need to find that dang code.

I know it's a long shot, but I know there's an active modding community here and hopefully someone's played with the canbus before.

 

I had this one hooked up to my truck. Worked great (unfortunately)!

 

You mean Cannibis? Reefer? Pot? They have a sniffing tool? Why?

 

I knew it'd be unlikely but didn't hurt to ask. Finding the messages being sent across CANBUS can be a powerful tool.

Let's say you drive a lot at night and like to turn the screen off. It's a bit of a hassle going to Settings > Display > Screen Off, so find the right messages and you can have it where pressing the Power button for 2 seconds shuts the screen off. Edit:
Maybe you switch between heat before work and AC after work. A little bit of code and long-press Fan Down to set it to 75°F, Low Fan, Top and Bottom vents. Long-press Fan Up, 60° / Medium Fan / Top Vents. Either add a temperature sensor or find the code for the car's ambient temp sensor and have heated seats / steering wheel come on automatically when it's below freezing. Sky's the limit.

I was hoping to find the messages to kick in the front camera view, then I'd have it triggered by either long-pressing the Eject button or swap in a gearshift lever with Descent Control buttons to manually activate the camera. I simply do not have access to ANY Ford vehicles with the factory front camera to read that code.

I always have some sort of project going on, just finished one to remote-start my Flex via text message so I don't have to be within 30 feet of the car. Old car, had it so remote starts would activate the heated seats and defrost since the car couldn't do that automatically.

Also realized just the degree of lurking I accomplished -- signed up 12 years ago, first post was here.

 

Turning off the screen, that would be nice! I had an Escape loaner for a few days and the only thing I liked about it was I could turn the screen off.

 

Different canbus modules will have different scripting, but what I've found so far is that the front panel buttons all use a similar pattern. This is all happening on I-CAN, which is probably HS3-CAN on the F150.

2A0 xx FF FF FF 10 00 1E 02 when a button is PRESSED
2A0 xx FF FF FF 10 00 1E 00 when a button is HELD
2A0 xx FF FF FF 00 00 1E 00 when a button is RELEASED

You would replace the xx with any of the values listed below. The safest pattern is to send Released, then Pressed, then Released again. I noticed the 'genuine' signals coming from the panel would always start off with a Released signal before the Pressed just to make sure there wasn't a stuck 'Held' signal in memory or something.

The values for xx I've found are
19 Phone
1F Audio Power
30 Sync Voice Prompt
32 Previous Track
33 Next Track
34 Eject CD
37 Track Information
39 Clock Settings
43 Satellite Radio
4F Source
18 Sound Settings
1F Power (Audio)
4A Tune +
4B Tune -
50 Screen Off
There's one for Mute somewhere in there too. While I was cycling through all the possible combinations, it put a little crossed-off speaker Mute icon in the status bar, but I don't remember which value it was.


Then for volume...
2A0 FF FF FF FF 00 00 1D 00 Volume Down
2A0 FF FF FF FF 00 00 1E 00 Set volume to 0 (but not Mute)
2A0 FF FF FF FF 00 00 1F 00 Volume Up
There is no pressed/held/released for these if you have the rotary dial. Send the message once to change the volume one point.


This was the code I used for testing 'turn off the screen when you hold POWER' -- It's VERY janky code, purely a test to see if it was possible and was never meant to be refined or efficient. It watches for the PRESSED signal, starting a secondary function that counts how many times the HELD signal comes through. Once the RELEASED signal shows up, it stops counting and checks the count. If at least 3 HELDs occured, it shuts the screen off and presses POWER again (because the music stops, naturally).

It's a learning process. I'm having fun but also incredibly frustrated that I just don't have access to a camera-equipped Ford like the big companies do that make those expensive add-a-camera modules.

 

We may have found our Forscan Guru. Thanks for all of the good info.

 

Ooh I should clarify, these won't do you much good in Forscan. The structure is similar to the AsBuilt we all love, but these messages are the live communications between modules. Forscan only deals with the stored settings within modules. Think of this more like a Gameshark or Action Replay -- it sends along live temporary signals instead of permanently changing the actual game code.

I'm not Russian enough to figure out stored settings

 

Like most software you just went so far over my head I'm lost. But it looks interesting and promising!

 

edit times fifty:
I'm a bit discouraged now because it looks like the F150 is just too different. Flex and Explorer both have the front panel communicate on HS3-CAN, but the F150's is on MS-CAN. Additionally, the IPMB that I don't have communicates on HS2-CAN, which I also don't have -- the Flex is just HS1, MS, and HS3-CAN (also called I-CAN).

Biggest problem is that Ford absolutely hated the Flex. Despite it being objectively better than the Explorer when they were first introduced, Ford has put zero development into the Flex since 2013. Only difference between a 2013 and 2019 is Sync3 and paint colors. Nobody's buying them anymore because you're paying 2019 Explorer prices for 2013 Explorer technology. No lanekeeping, no auto high beams, no radar cruise below 15mph... so trying to get information from a Sync3 Explorer is tricky because the Flex still uses the communications network of a Sync2 system.

Thinking it through further... I know that the FCIM can only communicate on HS3 because those are the only wires it has. HS3 connects to just audio-related components, including the APIM. The IPMB that the front and rear cameras connect to is only on HS2, which the Flex doesn't have. But somehow the signal needs to get from HS3 to HS2, either through the apim or the gateway module. If I had to put money on it, I'd say it goes through the apim because Flex doesn't have a gateway module and it still needs to send signals to HS1 and MS for climate control functions.

The APIM is kind of magical in that ALL the data lines connect to it, so it can function as a gateway if need be. Maybe just maybe the Explorer sends a front camera signal to the APIM, which then sends a signal to the IPMB to switch the feed. I don't know and without access to an Explorer, I'll never know.

Sucks, I just want this project to work. It's inconvenient having to put the car in reverse to get a front view.

 

Wow, that is awesome you can figure out how to do this! Hopefully you get the front camera figured out. So what exactly do I need to get the display to turn off like that in my F-150 that is one of the things I hate and would love to be able to power it down like that!

 

Which year is your truck, and what generation Sync? I can't give a definitive answer because of the differences between the Flex/Taurus/Explorer and the F150, but I can hopefully give you a close answer.

 

It’s a 2016 f150 with sync 3 software version 2.0

 

This is all gonna sound technical because I'm not the greatest at explaining things. I apologize in advance, it's really not as confusing as it sounds. One of those deals where it all kind of falls into place once you get going.

So the tricky bit here is a difference in the communications between the Flex/Explorer and F150 -- the Flex's front panel communicates on a high-speed CAN, while the F150 is on the medium speed. I'm sure the F150's APIM will likely respond to the 'screen off' signal the Flex generates if you were to send it over the HS-CAN. But, the part of the code that detects you pressing the Power button will be completely different, and a single CAN module for Arduino can only monitor a single CAN line.

A few options include
1) Instead of using the power button, just have some other momentary pushbutton or find another button to monitor on the HS-CAN. As long as the F150's APIM still responds to the 'Screen Off' signal that I use, you could activate it anytime with a pushbutton. My usual preference is swapping the gearshift **** for one that has a button, if yours doesn't currently.

2) Determine what the front panel button presses look like on MS-CAN for F150s, then see if you can discover a similar Screen Off command on MS-CAN. I mentioned earlier the pattern mine followed, where just changing the first two bytes changed the function. I had a simple script that would try every button press from 0 (0x00) to 256 (0xFF in hexadecimal) and took notes on which had an effect.

3) Have an Arduino with two separate CAN modules -- one to watch the Power button press on MS-CAN, another to send the Screen Off on HS-CAN. I'm not entirely sure how you'd set that up.


Hardware-wise, I went a bit fancier than I needed just to make sure it was easy to set up. The two main pieces of hardware are and a . There are cheaper 'clone' Uno boards on Amazon that use a different serial driver. If you are competent in installing drivers on your computer, you can save a few bucks by picking up a clone board -- I've personally never purchased a 'genuine' board. If this were a finalized project, you could even go with the much cheaper Arduino Nano and a smaller CAN module, but these have the advantage of simply snapping together, no wiring between them required.

There's plenty of guides on setting up the CAN-BUS shield, as it's nearly identical to the SparkFun CAN-BUS shield. It's late and I work in the morning, so I can't go into much detail on that now unfortunately.

The easiest way to read the codes once you have the software set up is to actually remove the front panel from your truck. Here's my front panel connected to my laptop, running off an M12 battery. Zoom in far enough and you'll see the codes on the laptop display showing the live messages coming from the front panel. You'll need a wiring diagram. The Flex's is just five pins off that board -- 12v, Hazard Switch, HS+, HS-, and Ground. Connected the HS+ and HS- to the shield, gave it power, and watched what came through. Not much, maybe 30 lines before it gave up. Saved these as a baseline for 'not pressing anything'. Then ran it again, but kept pressing Next Track and seeing what new signals appeared. Saved them, then Previous Track. Kept giong through trying all the buttons, then found the pattern. are convenient for a project like this -- they fit right on the pins and connectors on the car's wiring harnesses.

I can look more into it after work tomorrow as far as your truck's wiring diagram and what the best way to access the MS-CAN would be for 'live testing'.the codes. Because mine had the HS3-CAN connected straight to the obdii port, I used a to connect the shield to pins 1 and 9 on mine -- the F150 is likely different.

 

Thanks! I guess I will have to order those pieces. This might be over my head though right now 😂 I will have to start doing some research and get up to speed.