Bypass 'vehicle in motion' on bench setup

I built a sync3 bench tester with a microcontroller + CAN controller, OBD ELM cable… etc etc etc. I’ll spare you the technical details.

One thing i’m missing in my script is injecting a CAN message to override the ‘in-motion’ lock, so I can update via USB on the bench.

I tried injecting vehicle speed, but… no dice.

    unsigned char vehicleSpeed[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
    CAN.sendMsgBuf(0x215, 0, 8, vehicleSpeed);
    delay(15);

It’s a 2019 apim with 2015 asbuilt (manual transmission, so it’s not looking for ‘park’)
However, this script needs to work on 2016-2021 APIMs

FWIW - I am self-taught with a background in nerdy things, first time on here


SYNC Region: NA

Navigation Variant: Non Nav

Manufacturer Year: MY20

Install Type: Retrofit

Old SYNC Version: 3.4

New SYNC Version: 3.4

Do you have a error message, if so what is it?
N/A

Update Method: Official Ford

(post deleted by author)

how did you solved it?

        unsigned char vehicleSpeed[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
        CAN.sendMsgBuf(0x130, 0, 8, vehicleSpeed);
        delay(10);

looked at the TX/RX on the serial monitor output in arduino IDE from the CAN controller

I take that back actually. It was working.. but after a few APIM power cycles - it stopped working. (The APIM thinks it’s in motion.)

Not sure if this is overly technical for this forum, or if I am in fact in the right place; “latest posts” on here shows threads like “How 2 get radio 2 work I push buttons”

Fuckin technology how does it work

To clarify, my bench build works. I can connect to forscan, flash asbuilt, and fully boot any 2016-2021 sync3. It’s portable in a sealed junction box with 20v rechargeable power stepped down, or can switch to power supply.

What I’m trying to do now is really just ‘for fun’ functionality