[Success] Automatically select previous GOAT Mode (Sport, Slippery, etc) using Arduino + Canbus

[XirallicBolts]

[Edited 11/14/2023: New method, new code, new everything]

A common complaint across the forum is that the Bronco will prompt "Return to [] mode?" instead of staying in that mode.

I decided to automate pressing [OKAY] using an Arduino -- a cheap hobbyist microcontroller. Under the right conditions, it will send the same message on the Canbus as if I pressed [OKAY] manually. For the rest of this post, I'm going to refer to the Arduino+Canbus+Code as a 'Xirabus module'

I won't be able to go into extreme detail because I don't want this to turn into a giant novel of every possible way to implement it, so please bear with me. I'll probably edit this a dozen or so times as I keep trying to decide how to phrase things. My apologies to mobile users.

In an effort to avoid cutting any factory wiring, I also used a number of tools the average person likely won't have handy, unfortunately.

---

Theory of Operation
The xirabus module constantly watches the messages on HS2-CAN. Messages consist of a 3-byte ID, followed by up to 8 bytes of data.
What I've found so far is:

• ID 167 byte 0 seems to indicate the engine state. 00: Off | 20: Cranking | 52: Remote Start | 72: Running | B0: Auto-Stop | B6/76: ASS-Restarting
• ID 167 byte 3 has something to do with the current accessory mode. It's 00 when engine off, 10 when engine on.
• Every ~300 messages, a message with an ID of 18A is produced when the car is in Accessory or Run. I don't know what it is, but it stops immediately when the car is off.

Every new message xirabus reads, it increments a counter by 1.

If the message has an ID of 167, it stores the values of bytes 0 and 3 as EngineState and AccState.​

If the message has an ID of 18A, it resets the counter to zero.​

If the counter reaches 1,200 it will assume the Bronco is turned off -- 18A stops being produced, but other IDs continue being broadcast for several minutes.​

From this point, it will wait until the following is true:

1. 18A messages are being produced again.
2. EngineState is not 0x20 or 0x52. This is to make it wait during remote starts, where 18A will happen but the instrument cluster isn't ready to display 'Return to [] Mode?'
3. AccState is 0x10. This is to catch a condition where you stop the engine, but then restart it without opening the door.

Once all these conditions are met, it will wait 3½ seconds for the instrument cluster to wake up, then send an [OKAY Button Pressed] message ten times.
The xirabus has no idea if the prompt is actually on-screen, it just blindly presses the button. This will also dismiss any other prompts such as Door Ajar or Accessory Mode Active.
Unfortunately the prompt is generated by FD1-CAN, so I can't detect when it's really happening.


I've included the option to have it automatically select between 2WD/4HI/4A by connecting a jumper wire to ground.

Digital Pin 5: Connect to GROUND to select 2WD​

Digital Pin 6: Connect to GROUND to select 4-HI​

Digital Pin 7: Connect to GROUND to select 4-A​

If no jumper is installed, the car will switch to the default for the selected GOAT mode like normal.
Similar to sending the [OKAY Pressed] message, this broadcasts the same message you'd produce manually pressing the buttons on the GOAT dial.

---

Hardware
The easiest but bulkiest combination is an Arduino Uno and Canbus shield. Almost zero soldering is required.
A little more compact but more soldering is an Arduino Nano and MCP2515 Canbus module. (Wiring diagram available here, or image search 'mcp2515 wiring')

Smaller yet, I designed a custom PCB that combines the Arduino's main IC (ATMega328p) and the MCP2515 in a single board.
This method requires a USBASP programmer (to set the CLKOUT fuse bit in the ATMega) and an FT232RL (to upload the code).
Honestly this method isn't cost-effective if you're only making a single board for yourself, considering most of the needed components are sold in groups of 10+. If you aren't already doing hobby electronics, what are the odds you have a spare 5v regulator or 22pF capacitor in the junk drawer? I also don't know where to host the GERBER file to share the pcb design.


---

Wiring
To keep things simple, only four wires are needed. Power, ground, HS2CAN+, HS2CAN-. Conveniently, all four are connected to the GOAT selector switch. Removing the power window switches gives you just enough space to reach in and disconnect the pigtail.

As mentioned above, I wanted to avoid having to cut any factory wiring. To make a Y-cable, I designed and 3D printed a pair of adapters to use Dupont terminals. It's not 100% oem-matching but close enough to work reliably. The Arduino connects in parallel to all four wires.

The pinout for the GOAT switch connector is as follows:

Pin 1	White/Red	VBATT
Pin 2	Grey/Blue	HS2-CAN (-)
Pin 3	Green/Orange	HS2-CAN (+)
Pin 4	Black/Violet	GROUND
Pin 5	N/C	N/C
Pin 6	N/C	N/C

---

Program Code

Don't judge my methods, I'm not an expert coder. I typed half of this with the laptop sitting on my wife's lap in the passenger seat.



For posterity's sake, the command to set an ATMega's CLKOUT (Pin 8 becomes a clock output) is avrdude -p m328p -c usbasp -u lfuse:w:0xBF:m

Sponsored

 

[KT_bronco]

Been searching for a cool Arduino mod to play with. Nice to have someone with a bit of experience on the forums to give us a few projects to experiment with.

 

[Bmadda]

I am 100% down! This would be a lifesaver for me. It's 10x worse w/doors off and wheeling w/a group of people. In Moab, everywhere we stopped I had to remember to 1st buckle seat belt (otherwise door chime won't stop) then rapidly push 6x OKs before moving. Will be following this one!

 

[RagnarKon]

Cool stuff!!

I’ve been doing something similar with a Raspberry Pi and a CAN HAT. Not for this purpose… to be honest I prefer having my GOAT mode reset to the default setting automatically. But I’ve been poking around with Auto Start/Stop.

 

[Newbie]

#include <mcp_can.h> #include <SPI.h> #define CAN_INT 2 #define CAN_CS 10 MCP_CAN CAN0(CAN_CS); long unsigned int message_ID; unsigned char message_LENGTH = 0; unsigned char message_DATA[8]; unsigned char message_Steering_OK[8] = {0x10, 0x00, 0x00, 0x15, 0x00, 0x00, 0x00, 0x00}; void setup() { Serial.begin(115200); Serial.println("XirallicBolts 06/09/2023"); Serial.println("Bronco Select Previous GOAT Mode"); Serial.println("-------"); if(CAN0.begin(MCP_STDEXT, CAN_500KBPS, MCP_16MHZ) == CAN_OK) Serial.println("MCP2515 Initialized Succesfully"); else Serial.println("Could not initialize MCP2515 (CS 10, INT 2, 500KBPS, 16MHz"); CAN0.setMode(MCP_NORMAL); delay(3000); for(int i=0; i < 6; i++) { Serial.println("Sending OK Button"); CAN0.sendMsgBuf(0x081, 0, 8, message_Steering_OK); delay(1000); } }

 

[XirallicBolts]

How does the program work?
How do rainbows work?
How does the Positrac rear end on a Plymouth work?

[snip obsolete info]

The most important thing is that message -- ID 0x081, Data 0x10, 0x00, 0x00, etc. That message indicates when a button is being pressed on the steering wheel. The first byte (0x10) is the [OKAY] button. 0x08 is [UP ARROW], and I don't recall what any others were.

I spent a lot of time in my Flex with stuff like this so I could add a front camera, request it on-demand, automatically trigger heated seats and steering wheel in cold temperatures, always kick in massage seats, etc. Did it in my Milan too so the remote start would activate defrost and heated seats.

 

[Bmadda]

How does the program work?
How do rainbows work?
How does the Positrac rear end on a Plymouth work?

If we really wanted to strip out all the unnecessary fluff and have it run blind, the program gets simpler yet:

#include <mcp_can.h>
#include <SPI.h>
#define CAN_INT  2
MCP_CAN CAN0(10);

void setup() {
  CAN0.begin(MCP_STDEXT, CAN_500KBPS, MCP_16MHZ)
  CAN0.setMode(MCP_NORMAL);
  delay(3000);
  for(int i=0; i < 6; i++)
  {
    CAN0.sendMsgBuf(0x081, 0, 8, 0x10, 0x00, 0x00, 0x15, 0x00, 0x00, 0x00, 0x00);
    delay(1000);
  }
}

void loop() {
}

Tell it what extra libraries are needed (mcp_can.h, SPI.h), initialize the canbus module, wait 3 seconds, then loop 6 times of "send Okay message, wait 1 second". Done.

The most important thing is that message -- ID 0x081, Data 0x10, 0x00, 0x00, etc. That message indicates when a button is being pressed on the steering wheel. The first byte (0x10) is the [OKAY] button. 0x08 is [UP ARROW], and I don't recall what any others were.

I spent a lot of time in my Flex with stuff like this so I could add a front camera, request it on-demand, automatically trigger heated seats and steering wheel in cold temperatures, always kick in massage seats, etc. Did it in my Milan too so the remote start would activate defrost and heated seats.

1st off...thank you for buying a Bronco, cause skills like this are totally wasted on a Flex! 2nd off, 6 seconds is not fast enough to keep my config on a restart, but I did notice there was no penalty for extra "OKs". Can it fire off like 65 "OKs" per sec for like 3 secs on startup? I'm pretty sure 195 "OKs" would do it for sure, even if I forgot to buckle the seatbelt! Problem seems to be that each "OK" brings up more messages that require an additional "OK", and the lag in between sometimes gets ya...for instance...BONG...Vehicle is on-OK, BONG...doors are off-OK, BONG...do you want to return to rock crawl mode?-OK, BONG...Vehicle is on-OK, BONG...sway bar disconnect will reconnect at 20mph-OK, BONG...use brake switch to disengage parking brake-OK, If you had low washer fluid and low fuel in the middle of this clusterf$#k, you might never even hit the "do you want to return to rock crawl mode"-OK. But after a few days in Moab I learned to just pulse away on the OK button for a minute or so even after I was rolling (but hard w/a MT cause the button is on the right, and I gotta shift too!)

 

[XirallicBolts]

Yeah you can change the number of loops to whatever you want. I'd keep the delay between each press at 500ms minimum, it probably ignores extras between the messages. My testing for today was simply "is it the right message, does it do the thing?". Opened my doors and used accessory mode to generate a handful of messages, good enough for 99% use cases. You're kind of an edge case, lol

Idk why but i took the time to try and identify when the engine is running, despite the prompt appearing in accessory mode. I knew the prompt was in accessory even before i started searching for an "engine on" message.

 

[Bmadda]

Yeah you can change the number of loops to whatever you want. I'd keep the delay between each press at 500ms minimum, it probably ignores extras between the messages. My testing for today was simply "is it the right message, does it do the thing?". Opened my doors and used accessory mode to generate a handful of messages, good enough for 99% use cases. You're kind of an edge case, lol

Idk why but i took the time to try and identify when the engine is running, despite the prompt appearing in accessory mode. I knew the prompt was in accessory even before i started searching for an "engine on" message.

So...pardon my ignorance on computer lingo, but were you able to cypher the CAN message for KOER and KOEO/ACCESORY? (in Fordspeak KOEO=key on engine off, and KOER=key on engine running). Regardless of the goat mode fix, that could have other applications

 

[JONNEE]

...
How it works
As soon as it gets power, the Arduino waits 3 seconds. It then sends a message on HS2-CAN six times, once per second, identical to the message that comes from the SCCM when you press [OKAY]. The message repeats in case other messages are onscreen, such as "Door Ajar" or "Accessory Power Active".
...

Yee-hah! This is my kind of hacking! A new use for my Arduinos!

 

[XirallicBolts]

So...pardon my ignorance on computer lingo, but were you able to cypher the CAN message for KOER and KOEO/ACCESORY? (in Fordspeak KOEO=key on engine off, and KOER=key on engine running). Regardless of the goat mode fix, that could have other applications

I'm not sure there's anything on HS2 that can differentiate between the two reliably yet. I found a couple IDs that seemingly correspond to the tachometer but the Auto-start-stop complicates that. If I identify a specific byte that changes between the two, I don't have a good way of knowing if it's a module that only exists on higher trims.

I realize now that the "request camera when front radar detects objects" probably won't work. Forgot that the camera button is a direct connection to IPMB so there's no simulating a button press via canbus for that. That's the entire reason I can do it on the Flex -- there's no IPMB cancelling out my fake camera requests. REALLY annoying because the F150 Lightning will bring up camera view when objects are detected -- our IPMA doesn't have the corresponding AsBuilt sections for that.

It's raining out and my hardtop is off, so no experimenting with the hands-off alerts. That one will be tedious to do.

 

[Bmadda]

I'm not sure there's anything on HS2 that can differentiate between the two reliably yet. I found a couple IDs that seemingly correspond to the tachometer but the Auto-start-stop complicates that. If I identify a specific byte that changes between the two, I don't have a good way of knowing if it's a module that only exists on higher trims.

I realize now that the "request camera when front radar detects objects" probably won't work. Forgot that the camera button is a direct connection to IPMB so there's no simulating a button press via canbus for that. That's the entire reason I can do it on the Flex -- there's no IPMB cancelling out my fake camera requests. REALLY annoying because the F150 Lightning will bring up camera view when objects are detected -- our IPMA doesn't have the corresponding AsBuilt sections for that.

It's raining out and my hardtop is off, so no experimenting with the hands-off alerts. That one will be tedious to do.

I actually understood that, so maybe we are making progress. Also, just an idea, you can get Hs-CAN, power, and ground at the DLC. Could we make a little standalone module that just plugs into the DLC? Sorta like that thing they sell on Amazon to GM truck owners to disable the AFM?

 

[XirallicBolts]

This is obsolete wiring, you can safely ignore it


The +12v at OBDII is hot at all times, I went the easy route of using accessory power so it didn't need any specific trigger -- just press OK when it starts up, run code once. Having the arduino powered 24/7 means I'd have to keep track of ignition status.

Additionally, Ford changed how the OBDII port works -- it doesn't have direct access to any of the networks, just a dedicated "diagnostic can" to the gateway module with no traffic visible until a compatible reader wakes it up.

Took mine out for a test drive today and it worked beautifully. Swapped the Uno+shield for a Nano+mcp2515, moved my hs2 wires to the driver footwell, and tapped into the same add-a-fuse as my dashcam. Ziptied the works to the cable for the headlamp switch. Added a switch to enable/disable the output to the serial monitor for testing purposes -- sometimes I only want to read messages at a specific point like when I'm pressing a button.

A normal install won't have quite so much extra wire.

 

[cbrenthus]

I didn't quite read everything, but will this also remember the 4x4 setting? I want to keep mine in sport mode AND 2wd. Will this do that?

 

[XirallicBolts]

I didn't quite read everything, but will this also remember the 4x4 setting? I want to keep mine in sport mode AND 2wd. Will this do that?

I think so? Literally all this does is press the steering wheel "Ok" at that "Return to ____mode?" prompt when you start the car. If doing so kept it in Sport/2wd before, it should still now

Sponsored