Decoding the LIN frame of the light switch Mondeo mk4

[Uzi008]

Hi everyone!

I would like to share the results of my recent tests regarding the LIN bus analysis in the Ford Mondeo MK4. I have managed to 100% reverse engineer and decode the structure of the 2-byte frame with identifier PID 11 (0x11), which handles communication between the light switch (LSM – Light Switch Module) and the BCM (Body Control Module).

If any of you are building your own emulator, a LIN-CAN converter, or simply playing around with bench retrofits, this information will definitely save you a lot of time.

Network parameters:
- Frame ID: PID 11 (0x11)
- Baud rate: 9600 baud
- Specification: LIN v1.x (Checksum: Classic/Standard – calculated only from data bytes, excluding the ID).
- Length: 2 bytes (Data format: [Byte 1] [Byte 2])

Decoding Byte 1 (Main knob + Dimmer roller):
The main knob and dimmer roller values sum up mathematically in this byte.

Main light base values:
0x00 = Off
0x20 = Position / Parking lights
0x40 = Low beam
0x60 = AUTO mode

Dimmer roller values:
Accepts a smooth range from 0x00 (darkest) to 0x14 (brightest), which gives 21 positions in decimal format.

Examples for Byte 1:
- 20 = Position lights + roller at minimum (Checksum = 0xDF)
- 34 = Position lights + roller at maximum (0x20 base + 0x14 roller = 0x34, Checksum = 0xCB)
- 40 = Low beam + roller at minimum (Checksum = 0xBF)

Decoding Byte 2 (Fog lights):
The buttons are momentary. The switch outputs these values only for a fraction of a second while you physically hold the buttons down. Once released, the byte instantly returns to 0x00.

0x00 = Buttons released
0x20 = Front fog lights pressed
0x40 = Rear fog light pressed
0x60 = Both pressed simultaneously (0x20 + 0x40 = 0x60)

Example LIN Frame Structure:
Scenario: Low beam headlights ON + Dimmer roller at maximum (0x14) + No fog lights.

[Header from BCM] -> [Data bytes from Switch] -> [Checksum]

Code: Select all

PID 0x11 -> DATA: 54 00 -> CHECKSUM: 0xAB

How it sums up:

Code: Select all

Byte 1 = 0x40 (Low beam) + 0x14 (Roller max) = 0x54
Byte 2 = 0x00 (No fog lights)
Checksum = 0xAB (Calculated as: ~0x54 = 0xAB)

Verification: 0x54 + 0xAB = 0xFF (Classic LIN Checksum OK)

[Go4IT]

Hi, i did the same also for other LIN modules like battery sensor, alarm module, BCM. Me and AI developed a reverse engineering tool, which might be a benifit for you as well? https://github.com/igittigitt/esp32_lin_sniffer

[Uzi008]

Hi Go4IT, I'm also using AI to create a scanner and analyzer. I have the following test equipment: https://ucandevices.github.io/ulc.html
and a Chinese LIN bus converter:
DIYmall USB do LIN Debugger i Analizator - 16-kanałowy kontroler magistrali LIN z wyjściem 12V (4800-20000bps)
https://a.aliexpress.com/_EzJiI5u
I'm also using the Saleae Logic Analyzer clone.
Your project looks very interesting. I have an ESP32 somewhere, so I'll definitely give it a try.

Best regards

[ZvonimirG]

Hi Go4IT, I'm also using AI to create a scanner and analyzer. I have the following test equipment: https://ucandevices.github.io/ulc.html
and a Chinese LIN bus converter:
DIYmall USB do LIN Debugger i Analizator - 16-kanałowy kontroler magistrali LIN z wyjściem 12V (4800-20000bps)
https://a.aliexpress.com/_EzJiI5u
I'm also using the Saleae Logic Analyzer clone.
Your project looks very interesting. I have an ESP32 somewhere, so I'll definitely give it a try.

Best regards

Hi!

Wich software you for LIN?

[Go4IT]

Saw the link at top?

[ZvonimirG]

Yes i saw That but Can I Use That software with This Interface?

Screenshot_20260916_114011.jpg

[Go4IT]

The interface itself does not matter, it is all about the protocol it talks to your PC. What interface is this? What protocols does it use? Is it programmable and which microcontroller is soldered? Or is it just USB brdige?

[Go4IT]

found it, just USB

IMG_7204.png

My software currently does not support this.