Decoding the LIN frame of the light switch Mondeo mk4
Posted: 25 Jul 2026, 18:08
Hi everyone!
I would like to share the results of my recent tests regarding the LIN bus analysis in the Ford Mondeo MK4. I have managed to 100% reverse engineer and decode the structure of the 2-byte frame with identifier PID 11 (0x11), which handles communication between the light switch (LSM – Light Switch Module) and the BCM (Body Control Module).
If any of you are building your own emulator, a LIN-CAN converter, or simply playing around with bench retrofits, this information will definitely save you a lot of time.
Network parameters:
- Frame ID: PID 11 (0x11)
- Baud rate: 9600 baud
- Specification: LIN v1.x (Checksum: Classic/Standard – calculated only from data bytes, excluding the ID).
- Length: 2 bytes (Data format: [Byte 1] [Byte 2])
Decoding Byte 1 (Main knob + Dimmer roller):
The main knob and dimmer roller values sum up mathematically in this byte.
Main light base values:
0x00 = Off
0x20 = Position / Parking lights
0x40 = Low beam
0x60 = AUTO mode
Dimmer roller values:
Accepts a smooth range from 0x00 (darkest) to 0x14 (brightest), which gives 21 positions in decimal format.
Examples for Byte 1:
- 20 = Position lights + roller at minimum (Checksum = 0xDF)
- 34 = Position lights + roller at maximum (0x20 base + 0x14 roller = 0x34, Checksum = 0xCB)
- 40 = Low beam + roller at minimum (Checksum = 0xBF)
Decoding Byte 2 (Fog lights):
The buttons are momentary. The switch outputs these values only for a fraction of a second while you physically hold the buttons down. Once released, the byte instantly returns to 0x00.
0x00 = Buttons released
0x20 = Front fog lights pressed
0x40 = Rear fog light pressed
0x60 = Both pressed simultaneously (0x20 + 0x40 = 0x60)
Example LIN Frame Structure:
Scenario: Low beam headlights ON + Dimmer roller at maximum (0x14) + No fog lights.
[Header from BCM] -> [Data bytes from Switch] -> [Checksum]
How it sums up:
Verification: 0x54 + 0xAB = 0xFF (Classic LIN Checksum OK)
I would like to share the results of my recent tests regarding the LIN bus analysis in the Ford Mondeo MK4. I have managed to 100% reverse engineer and decode the structure of the 2-byte frame with identifier PID 11 (0x11), which handles communication between the light switch (LSM – Light Switch Module) and the BCM (Body Control Module).
If any of you are building your own emulator, a LIN-CAN converter, or simply playing around with bench retrofits, this information will definitely save you a lot of time.
Network parameters:
- Frame ID: PID 11 (0x11)
- Baud rate: 9600 baud
- Specification: LIN v1.x (Checksum: Classic/Standard – calculated only from data bytes, excluding the ID).
- Length: 2 bytes (Data format: [Byte 1] [Byte 2])
Decoding Byte 1 (Main knob + Dimmer roller):
The main knob and dimmer roller values sum up mathematically in this byte.
Main light base values:
0x00 = Off
0x20 = Position / Parking lights
0x40 = Low beam
0x60 = AUTO mode
Dimmer roller values:
Accepts a smooth range from 0x00 (darkest) to 0x14 (brightest), which gives 21 positions in decimal format.
Examples for Byte 1:
- 20 = Position lights + roller at minimum (Checksum = 0xDF)
- 34 = Position lights + roller at maximum (0x20 base + 0x14 roller = 0x34, Checksum = 0xCB)
- 40 = Low beam + roller at minimum (Checksum = 0xBF)
Decoding Byte 2 (Fog lights):
The buttons are momentary. The switch outputs these values only for a fraction of a second while you physically hold the buttons down. Once released, the byte instantly returns to 0x00.
0x00 = Buttons released
0x20 = Front fog lights pressed
0x40 = Rear fog light pressed
0x60 = Both pressed simultaneously (0x20 + 0x40 = 0x60)
Example LIN Frame Structure:
Scenario: Low beam headlights ON + Dimmer roller at maximum (0x14) + No fog lights.
[Header from BCM] -> [Data bytes from Switch] -> [Checksum]
Code: Select all
PID 0x11 -> DATA: 54 00 -> CHECKSUM: 0xABCode: Select all
Byte 1 = 0x40 (Low beam) + 0x14 (Roller max) = 0x54
Byte 2 = 0x00 (No fog lights)
Checksum = 0xAB (Calculated as: ~0x54 = 0xAB)