DIAG GOLD← CAN Bus Playbook
Ford Network Map
Ford transitioned to CAN in the 2004 model year (some 2003 models), using an HS-CAN bus at 500 kb/s accessible on DLC pins 6 and 14 and an MS-CAN bus at 125 kb/s for body/convenience modules. Around 2018, Ford introduced a Security Gateway Module (SGW) requiring J2534 passthru authentication for module programming and many secure functions. Pre-2004 models used J1850 PWM and/or ISO 9141. Aftermarket remote start and alarm installations are a leading cause of network faults.
Testing values and scope patterns are universal — they live on the main CAN playbook. This page is what's specific to Ford: the buses, where the terminators live, and what breaks. Tap any era to explore it — network map, testing guide, failure patterns.
2004-2017
| Bus | Speed | Carries | DLC access | Terminators live in |
|---|---|---|---|---|
| HS-CAN | 500 kb/s | PCM, ABS, restraints (RCM), instrument cluster (IPC) | DLC pins 6 and 14 | not independently confirmed |
| MS-CAN | 125 kb/s | BCM, HVAC, door modules, lighting | DLC pins 3 and 11 (non-standard pair — generic scan tools need an MS/HS-switch adapter) | not independently confirmed |
GatewayInstrument cluster (IPC) or Body Control Module (BCM), depending on platform
Explore this era ⤢2018-present
Security Gateway (SGW) era
SGW requires Ford IDS/FDRS with valid J2534 passthru session for module programming; generic tools can read codes but cannot perform secure functions. Recovery from lockout requires an OEM passthru session.
| Bus | Speed | Carries | DLC access | Terminators live in |
|---|---|---|---|---|
| HS-CAN | 500 kb/s | PCM, TCM, ABS, RCM, PSCM; some driver-assist/camera modules may reside on separate buses | DLC pins 6 and 14, SGW authentication required for reprogramming and many bi-directional tests | not independently confirmed |
| MS-CAN | 125 kb/s | BCM, HVAC, door modules, lighting | via gateway | not independently confirmed |
GatewaySecurity Gateway Module (SGW), location varies by platform
Explore this era ⤢What breaks on Fords
Instrument cluster gateway failure (2004-2016)
In the 2004-2016 era, the instrument cluster (acting as gateway) can fail, causing loss of HS-CAN communication with multiple modules, U0100 and related U-codes, and partial or complete network dropout. Common on F-150, Explorer, Escape, Fusion.
Driver door module water intrusion / MS-CAN short
Water enters the driver door zone module through the switch connector or door seam, shorting MS-CAN. Symptoms include inoperative windows/locks, BCM/door B-codes, and MS-CAN faults. Common on Fusion, Edge. Inspect door membrane and switch connectors for water staining.
BCM water intrusion affecting MS-CAN
The Body Control Module (typically under dash, driver side) is susceptible to water intrusion from cowl/HVAC drains or windshield leaks. Corroded BCM connectors cause intermittent MS-CAN faults and lighting/accessory failures.
Aftermarket remote start / alarm CAN tie-in
Aftermarket accessories tapping CAN at the DLC or behind the cluster/BCM frequently cause communication loss, U-codes across multiple modules, and no-start conditions. Improper splicing (piercing insulation, wrong resistors) leads to corruption. Remove the add-on device and inspect the harness.
APIM (Sync) module lockup
A failed or locked APIM can drag down or corrupt its bus. Symptoms: slow cluster boot, intermittent accessory faults, scan tool sees some modules but not others. Isolate by pulling the APIM fuse.
SGW lockout after failed programming (2018+)
The Security Gateway Module enters lockout after interrupted module programming or a voltage drop during an update, producing widespread U-codes or complete scan tool lockout. Requires a Ford IDS/FDRS passthru session to recover. Maintain stable voltage during all programming; do not power-cycle during a flash.
The bench — what to test with
Quality DVOM with a 200-ohm manual range and backprobe pins$40-120; a $40 meter truly is enough for resistance and voltage work if it's accurate.
Terminator resistance, bias voltage, and split-half short hunting are the majority of Ford CAN diagnosis — a good meter with a stable manual 200-ohm range does all of it.
2-channel automotive oscilloscope$200-500 for a usable 2-channel handheld; you don't need a lab scope for CAN.
The only tool that shows edge quality, ringing, and reflections — it catches a marginal/missing terminator, a too-long aftermarket stub, one-line-dead conditions, and a second device fighting the bus that a meter reads as 'fine.'
DLC breakout box / T-adapter with backprobe leads$20-80.
Lets you land probes on pins 6/14 and 3/11 cleanly without deforming DLC terminals, and keeps the tool connected while you meter.
MS/HS-CAN switch DLC adapter$15-60.
Non-negotiable for 2004-2017 MS-CAN work with a generic scan tool — the body bus lives on non-standard pins 3/11 and a plain OBD-II tool won't see it without the adapter.
Fine back-probe pin set / T-pins$15-40.
Reaching a gateway-hidden MS-CAN at a body module connector requires backprobing a seated connector without piercing insulation — piercing is exactly the aftermarket sin that causes these faults.
Ford IDS/FDRS with a J2534 passthru interfaceSubscription + a compatible J2534 device (~$150-1500 depending on model); required, not optional, for SGW-era secure work.
The only honest way to authenticate the SGW, perform secured/programming functions, and recover a 2018+ gateway lockout — no meter substitutes.
Battery maintainer / stable power supply$50-300 depending on amperage.
Voltage drops during a flash are a leading cause of SGW lockout — keep the pack topped before any programming.
Scan-tool access
Pre-2004 models use J1850 PWM (pins 2/10) or ISO 9141; 2004+ is CAN-based but may retain J1850/ISO modules through 2007 depending on platform. Generic OBD-II scanners access HS-CAN (pins 6/14) for federally mandated systems. From 2018+, the Security Gateway Module (SGW) requires a VIN-linked passthru session via Ford IDS or FDRS for module programming and most secure functions; generic tools can read codes and PIDs but cannot perform secured operations. Aftermarket tools report 'security access denied' when SGW blocks a function.
Don't agree?
Send us your feedback — we're always looking to get better: [email protected]