Controller-Area Network or CAN Bus is one of many automotive communication buses for communications between various ‘car computers’. Information such as speed, fuel consumption, accelerator pedal position is all transmitted between the various controllers of a car akin to ‘fly-by-wire’ control systems of aircraft but I guess ‘drive-by-wire’ is more appropriate in this case.
There are other rival bus technologies include LIN (Local Interconnect Network) which is supposed to be a lower cost alternative to CAN, but I’m not interested in that. Why? My car uses the CAN bus, not LIN, not Ethernet. So lets go about figuring what can be gleened from the communications whizzing around my car!
Background / Reason Why
In June 2006 I bought a ‘new’ car, an Australian Mazda 3 Facelift Model. The car was a great drive, Mazda excelled in the build and features but one thing nagged at me – the speedometer. It was stylish I had to admit but the scaling was ‘off’ to me. 0 speed was vertically down and the scaling was… better not rant on but the thought was ‘maybe I can get another speedometer on’. A history of my ‘better speedometer’ fantasies follow
A little bit of research later I found out the Mazda had two CAN buses: a ‘HS-CAN’ (High Speed) network on which most of the essential systems (ECU, ABS) were connected, and a slower ‘MS-CAN’ (Medium Speed?) network on which accessories such as the audio system were connected. These two networks are joined together by the instrument panel which also acts as the gateway to allow some messages to pass between the two networks. Both buses are conveniently available via a ‘standard’ J1962 plug just below the steering wheel (Do a search on OBD) so I didn’t have to hack anything open.
[Note : Most of the information below is from back in 2006, I only recently picked this project back up]
[Note 2 : Please don't any of what I say below if you're not familiar with electronics/cars or if you value your life... I hold no responsibility for anything that happens... I need to learn how to write a better disclaimer]
So what is on the network exactly?
Officially? ‘I dunno’. Mazda naturally doesn’t publish this information nor can it be found on the net easily, I hope Mazda doesn’t take offense at me writing this post actually… I loved the car and I’m doing this because its such a great car [/grovel].
Now if that information isn’t forthcoming from the great ol’ google, I just had to try figure it out for myself!
How it was done
First step – Find the pin-outs of the J1962 connector, since its standard connector albeit with slightly different pin-outs per car type the answer is easily found on google. Go search it up yourself
Second step – Oscilloscope. A lovely portable fluke connected to the two CAN bus lines told me the baud rates of each of the two buses. 500kbps and 125kbps respectively.
Third step – Start sniffing, or at least buy the stuff to do so. I had wanted to build my own CAN interface board but laziness got the better of me and I bought the cheapest one online I could find from QProtos. In hindsight it wasn’t the best choice but it wasn’t that bad either. Coupled with a J1962 cable from OBD2Cables.com (only remember them because i’m still receiving email offers hehe) I had everything I need to start.
Fourth step – Really start sniffing. A precaution I took was to set the CAN-USB adaptor to ‘listen’ mode only, I didn’t want to risk the brakes suddenly not working.
A bunch of static tests to start things off nice and slow. The methodology was simple, start the CAN bus logging then carry out actions on the car at certain times – turn the blinker, step on the accelerator etc. All was left to be done was to review the logs to see which bits or bytes changed at those matching times.
Fifth step – The fun bit! Dynamic testing! This time with the same setup as above but with my GPS phone logging simultaneously too. Oh what fun you can achieve here.
Anyone familiar with the Australian Design Rules and the laws? The displayed vehicle speed must not be reported lower than actual, so what most manufacturers do is artificially bump that number up. Hence you see the almost always consistently higher CAN speed compared to the GPS speed… Hey I haven’t even said how many ‘speed’ signals are transmitted across the CAN bus…the ‘actual’ (unmodified) one is there too.
The state of affairs
As of the end of 2006 (Yes two years ago) I had mapped out … (in no particular order…well actually in order of CAN bus ID’s)
On the HS-CAN
- Brake Active
- Vehicle Speed
- Accelerator Pedal position
- Brake Active (Again)
- True Vehicle Speed
- Gear Position – Park
- Gear Position -Reverse
- Gear Position -Drive
- 1st, 2nd… etc Gears
- Gear Shift
- Manual/Tiptronic Selection [Yes I drive an Auto]
- Gears again…
- Accelerator Pedal position again…in a different scaling…Mazda is strange
- Left Front Wheel Speed
- Right Front Wheel Speed
- Left Rear Wheel Speed
- Right Rear Wheel Speed
- Steering Wheel Angle (I’m going to have fun with this one!)
On the MS-CAN
- RPM (Retransmitted)
- Vehicle Speed (Retransmitted)
- Head Unit LCD Display (Oh this will be fun too)
- TRIP COMPUTER! Average Speed, Fuel Consumption, Average Fuel Consumption, Distance Remaining
Oh I so forgot to rant. Trip Computer, very nice little pieces of information for driving a car. Official Mazda Australia line? Oh our Mazda 3’s don’t have this. All overseas models have it. All information is already on the car. The car even has a head unit with all the trip computer LCD displays present (you can see it if you tilt your head). Infact there’s a little trick you can do with every Mazda 3 model just prior to mine that you can hold down certain keys on the head unit before starting the car that activates it… but nooooooooooooo its disabled on mine for what reason I don’t know… erm… rant over. Guess I have to do a better speedometer and trip meter too.
If anyone was expecting to see the results, you have to wait for Part 2 (or 3)…does anyone actually want to see? Or got any questions? mmmmPlease Flattr me if you found this useful :)