Reverse Engineering the Mazda CAN Bus – Part 1

Controller-Area Network or CAN Bus is one of many automotive communication buses for communications between various ‘car computers’.  Information such as speed, fuel consumption, accelerator pedal position is all transmitted between the various controllers of a car akin to ‘fly-by-wire’ control systems of aircraft but I guess ‘drive-by-wire’ is more appropriate in this case.

There are other rival bus technologies include LIN (Local Interconnect Network) which is supposed to be a lower cost alternative to CAN, but I’m not interested in that.  Why?  My car uses the CAN bus, not LIN, not Ethernet.  So lets go about figuring what can be gleened from the communications whizzing around my car!

Aside from CAN bus, my car has a pig too.  This photo is from 2 years ago and the pig no longer has the tail or the tag on its ass...
Aside from CAN bus, my car has a pig too (Long story). This photo is from 2 years ago and the pig no longer has the weird thing hanging from its belly or the tag on its ass...

Background / Reason Why

In June 2006 I bought a ‘new’ car, an Australian Mazda 3 Facelift Model.  The car was a great drive, Mazda excelled in the build and features but one thing nagged at me – the speedometer.  It was stylish I had to admit but the scaling was ‘off’ to me.  0 speed was vertically down and the scaling was… better not rant on but the thought was ‘maybe I can get another speedometer on’.  A history of my ‘better speedometer’ fantasies follow 😉

My old (and free!) Sony Ericson showing my speed on a MagLev
My old (and free!) Sony Ericson showing my speed on a MagLev
Testing the feasibility of using the same crappy phone as a HUD on another car of mine on a rainy night...
Testing the feasibility of using the same crappy phone as a HUD on another car of mine on a rainy night...yup that's the image on my windscreen!

A little bit of research later I found out the Mazda had two CAN buses: a ‘HS-CAN’ (High Speed) network on which most of the essential systems (ECU, ABS) were connected, and a slower ‘MS-CAN’ (Medium Speed?) network on which accessories such as the audio system were connected.  These two networks are joined together by the instrument panel which also acts as the gateway to allow some messages to pass between the two networks.  Both buses are conveniently available via a ‘standard’ J1962 plug just below the steering wheel (Do a search on OBD) so I didn’t have to hack anything open.

[Note : Most of the information below is from back in 2006, I only recently picked this project back up]

[Note 2 : Please don’t any of what I say below if you’re not familiar with electronics/cars or if you value your life… I hold no responsibility for anything that happens… I need to learn how to write a better disclaimer]

So what is on the network exactly?

Officially?  ‘I dunno’.  Mazda naturally doesn’t publish this information nor can it be found on the net easily, I hope Mazda doesn’t take offense at me writing this post actually… I loved the car and I’m doing this because its such a great car 😉 [/grovel].

Now if that information isn’t forthcoming from the great ol’ google, I just had to try figure it out for myself!

How it was done

First step – Find the pin-outs of the J1962 connector, since its standard connector albeit with slightly different pin-outs per car type the answer is easily found on google.  Go search it up yourself 🙂

Second step – Oscilloscope.  A lovely portable fluke connected to the two CAN bus lines told me the baud rates of each of the two buses.  500kbps and 125kbps respectively.

Third step – Start sniffing, or at least buy the stuff to do so.  I had wanted to build my own CAN interface board but laziness got the better of me and I bought the cheapest one online I could find from QProtos.  In hindsight it wasn’t the best choice but it wasn’t that bad either.  Coupled with a J1962 cable from OBD2Cables.com (only remember them because i’m still receiving email offers hehe) I had everything I need to start.

Fourth step – Really start sniffing.  A precaution I took was to set the CAN-USB adaptor to ‘listen’ mode only, I didn’t want to risk the brakes suddenly not working.

A bunch of static tests to start things off nice and slow.  The methodology was simple, start the CAN bus logging then carry out actions on the car at certain times – turn the blinker, step on the accelerator etc.  All was left to be done was to review the logs to see which bits or bytes changed at those matching times.

Fifth step – The fun bit!  Dynamic testing!  This time with the same setup as above but with my GPS phone logging simultaneously too.  Oh what fun you can achieve here.

Speed from GPS vs Speed from CAN bus
Speed from GPS vs Speed from CAN bus

Anyone familiar with the Australian Design Rules and the laws?  The displayed vehicle speed must not be reported lower than actual, so what most manufacturers do is artificially bump that number up.  Hence you see the almost always consistently higher CAN speed compared to the GPS speed… Hey I haven’t even said how many ‘speed’ signals are transmitted across the CAN bus…the ‘actual’ (unmodified) one is there too.

The state of affairs

As of the end of 2006 (Yes two years ago) I had mapped out … (in no particular order…well actually in order of CAN bus ID’s)

On the HS-CAN

  • Brake Active
  • RPM
  • Vehicle Speed
  • Accelerator Pedal position
  • Brake Active (Again)
  • True Vehicle Speed
  • Gear Position – Park
  • Gear Position -Reverse
  • Gear Position -Drive
  • 1st, 2nd… etc Gears
  • Gear Shift
  • Manual/Tiptronic Selection [Yes I drive an Auto]
  • Gears again…
  • Accelerator Pedal position again…in a different scaling…Mazda is strange
  • Left Front Wheel Speed
  • Right Front Wheel Speed
  • Left Rear Wheel Speed
  • Right Rear Wheel Speed
  • Steering Wheel Angle (I’m going to have fun with this one!)
  • Odometer

On the MS-CAN

  • RPM (Retransmitted)
  • Vehicle Speed (Retransmitted)
  • Head Unit LCD Display (Oh this will be fun too)
  • TRIP COMPUTER! Average Speed, Fuel Consumption, Average Fuel Consumption, Distance Remaining

Oh I so forgot to rant.  Trip Computer, very nice little pieces of information for driving a car.  Official Mazda Australia line?  Oh our Mazda 3’s don’t have this.  All overseas models have it.  All information is already on the car.  The car even has a head unit with all the trip computer LCD displays present (you can see it if you tilt your head).  Infact there’s a little trick you can do with every Mazda 3 model just prior to mine that you can hold down certain keys on the head unit before starting the car that activates it… but nooooooooooooo its disabled on mine for what reason I don’t know… erm… rant over.  Guess I have to do a better speedometer and trip meter too.

If anyone was expecting to see the results, you have to wait for Part 2 (or 3)…does anyone actually want to see?   Or got any questions? mmmm

54 thoughts on “Reverse Engineering the Mazda CAN Bus – Part 1”

  1. Yeah, greate post!!! Whant to see next parts…. 🙂
    On our local forums i have find mans made can bus controller, who read data from parktronic, anr sent it to build-in on-board audio display. Wery interested in it!

  2. hey Medox,

    I’m an electrical engineering student and I’m doing a project on car can-bus.I found your post while looking for some data about the can-bus on Mazda, because I also drive one and I would like to use it for testing my project (eventually, I wanna build a “cruise control” for my car 🙂

    I was hoping maybe you’d like to share some info (well, mainly sharing your discoveries, since we’re only starting…).
    any thing you have will be useful for for me.

    thanks,
    Elad

  3. I’m looking to retrace many of your steps, and maybe go farther, using a 2006 MX-5. What did you find lacking in the qprotos interface, and what would you recommend instead?

    1. Hi Jim,
      I’m not sure if I can comment now because its been so long. I believe it was the clumsy software back then, it didn’t have timestamps in the logs or the timestamps were only to seconds resolution (this has been fixed in the version 1.8 of their software).

      The frustrating thing I find now is that I can’t use this under linux easily… but overall the qprotos wasn’t bad for its price. I think it was just the cheapest, there may be better but it’ll cost you. (I bought it as an experiment/throwaway item…)

      PS : Could you share anything you find for the MX-5? 🙂

  4. Somehow there’s always promising hardware with junk software out there. At least qproto provides info to create your own software, which is good. There are better-looking products out there, but they start to get expensive — I’m looking for the same kind of throw-away experimental stuff you were, and you get what you pay for.

    Will be glad to share any MX-5 info.

  5. Hey, what cable did you order from obd2cables? I checked the wiring diagrams on their cables, and nothing is even remotely close to the pinout of the qprotos interface, or the EasySync (which is what I ended up ordering). Did you have to rewire the cable, or am I missing something?

  6. I bought the one with the J1962 connector on one end and un-terminated wires on the other end. You’ll then have to terminate the wires to a DB-9 connector suitable for whichever adapter you buy.

    The pinout’s of the J1962 connector is in the Mazda manuals, the connector designator in the manuals is called “DLC-2”.

    Or you can wait 10 hours for me to find my notes and post it up 🙂

    You’ve already ordered?… I just found this one

    http://www.mhs-elektronik.de/cgi-bin/mhs.pl?id1=2&id2=0

    You then have to look up the pin-out for the J1962 connector

  7. OK, I can wire up the DB9 connector easily enough — I just wanted to be sure I wasn’t misinterpretting the conflicting pinouts. And I’ve got the OBD-II pinout, that’s easy.

    The Tiny-CAN looks OK, but it’s not clear whether anything is documented in English, and while my ancestry comes from Germany, I don’t speak the language. Yes, my EasySync is on order already.

    Thanks for answering questions, much appreciated.

    BTW, were you happy with the Alibre Design software you used on the iris? Based on your recommendation I downloaded a copy, and I’m having a lot of trouble getting it to work reliably. I’m new to 3D drawing, so at least part of the issue is certainly me, but I’ve had the thing mysteriously stop obeying the same commands that worked earlier — and worked again, once the program was reloaded. I also can’t get “cosmetic threaded holes” to work at all.

    jim

    1. Your mileage may vary but here are the pin-outs for the J1962M connector on my car… (pulled off a convention centre writing pad… I must have done this when I was bored…)

      6 – CAN H (HS) [White/Black]
      14 – CAN L (HS) [Green/Black]
      3 – CAN H (MS) [Brown]
      11 – CAN L (MS) [Purple]
      4 – Body GND [Red]
      5 – Signal GND [Orange]
      16 – Battery +ve [Light Blue]

      Colours are for the cable I have, which again may vary so I suggest a multimeter/scope test on the pinouts. OBD-II pinouts don’t necessarily mean much by the way, you’ll probably get one of the two CAN busses? I got mine out from a Mazda maintenance manual for a Mazda 3.

      Edit : Ooo ooo the EasySync adapter looks good and great price…ooo ooo…I hate you…for tempting me with this…must resist urge to buy (but ultimately I know I’m doomed to fail)

      1. Madox,

        I’m trying to piece together information from this site to get my setup going. I’m using a CANUSB Adapter with the same open-ended J1962M cable from odb2cables.com. My problem is, the pin outs listed above seem to be drastically different from what I’ve pulled up. I wanted to know which ones are the right ones.

        Here’s the connector information from a Mazda 3 technical manual:

        http://www.clubnet.org/~clave/dlc.html

        As you can see, it’s drastically different from what you (Madox) posted. (I’m taking the pin #’s into consideration and ignoring the colors, even though the colors on my cable match yours).

        Thoughts?

        1. Hi Jerry,

          Sorry for the slow reply, I’m overseas at the moment 😉

          The pin-out I gave is exactly the same as the one you referenced on the website. It is a rather odd numbering scheme, on the webpage – the bottom right is pin 1, and the top left is pin 16, each row is numbered from right to left.

          You’ll noticed on the obd2cables connector that it has very small text with at least pins 1 and 16 numbered.

          Good luck 🙂

          1. Hey Madox,

            Thanks for the reply! … and all the hard work you’ve put into this project initially.

            Look closely. =) If you look at MY reference, pins 11 and 3 are actually the highspeed network, pins 6 and 14 are the medium speed network… and the grounds are reversed…

            I figured out why. 🙂 YOUR pin out is the proper one. My pin out is the RECEPTACLE’s pin out. Meaning when you plug into it, the pins are on the opposite side. I found this out by following my diagram and ended up tapping into the HS network when it should have been the MS network. I eventually clued in. =)

            So to anyone who wonders, follow Madox’s pinout. =)

          2. You’ve just royally confused me 🙂

            The socket and plug pin-outs are identical, pin 1 goes into pin 1…pin 16 goes into pin 16…
            The ‘D’ shaped connector just looks mirrored if you hold them both facing you…

            That’s why I always go with pin numbers than ‘left’ / ‘right’ / ‘top’ / ‘bottom’! Thank goodness those obd2cables aren’t too shabby and have labels.

    1. EasySync UK doesn’t ship to overseas destinations on the webpage…(Emailed them).
      EasySync USA (which I only found via google) wants to charge me $68USD for shipping via UPS when the device only costs $88USD.

      Geez…. they sure know how to help me resist buying this thing! [Loved the plain terminal API!]

  8. Ordered it for 60GBP + 10GBP postage. Base device is slightly more than US site, but shipping is so much more reasonable. The sales person at EasySync UK was really helpful. Will update posts when I get to play with this much easier to use (hoping…) adapter.

    1. I have a problem:
      I am using a PIC18F458 with integrated CAN controller and a MCP2551 CAN tranceiver, 16 MHz oscillator (with High Speed no PLL), 124 Ohm between CAN H & CAN-L, + about 1m of cable.
      On CAN – MS 125Kbps:
      For some reason I cannot receive any frame after about 3-4 seconds, but the transmission works fine (with the application above). Last time when I checked there were a lot of error interrupts for reception.
      The baud configuration is the following:
      BRGCON1.BRP = 7
      BRGCON1.SJW = 0
      BRGCON2.PRSEG = 0
      BRGCON2.SEG1PH = 2
      BRGCON2.SAM = 0 (sampled once)
      BRGCON2.SEG2PHTS = 1 (segment 2 phase freely programable)
      BRGCON3.SEG2PH = 2 (phase of segment 2)
      BRGCON3.WAKFIL = false

      Has anyone good settings for CAN on either speed. There might be some other reason for losing the communication after 3 seconds, some other settings.

      Please see my posts on the frame id-s page http://www.madox.net/blog/mazda-can-bus/
      I try to make a fuel trip computer using the radio’s LCD. I have a 2008 model. Has anyone found a way for activating it for 2008 models, either by CAN or some buttons ?

      Gaby
      gaby.radulescu at gmail.com

  9. Quite an interesting article. Excuse my ignorance but what is the relation between OBD-2 and CAN?

    I am interested in pulling similar data from an 2006 RX8 ECU in a clubman kit car I am building, but I will also need to check DTC codes and clear them as a lot of the original parts will no longer be connected. Am I able to check and clear these with the same hardware that you’ve used in this article or do I need something else?

    1. Hello fellow Aussie 😉

      OBD is a standardization of on-board diagnostics on cars and CAN bus is one of the methods to connect to on-board computers on a car to read OBD information.

      I suggest you do some further reading elsewhere to find out more, you’ll need more software to read/clear DTC codes and the like. I had no interest in them whatsoever for my project…

      1. Hi Madox,

        I’ve been looking into CAN and OBD a bit more and I thought you might be interested in the project I will be undertaking. I am looking at using data from the CAN network to display on a Asus EEE PC T91 tablet as a complete dash replacement. I am also considering combining this data with GPS information and possibly data from an accelerometer as a track data logger as well.

        I’m running my own blog here http://lukesclubmanbuilddiary.blogspot.com/ if you were interested in following.

        1. Expensive! 🙂 The T91 isn’t cheap for what it is [I had considered it before getting this ProBook 5310m].
          But if you’ve seen some of the test videos I’ve done, its with an Asus R1F 🙂

          1. Yeah it is probably a bit of overkill. The main selling points were the integrated 3G and GPS with the touch+tablet (no need to pull it apart) being a plus. I could probably live with a EEE PC 901 which I should be able to get for close to half the price. The GPS and 3G can be added pretty easily.

            Two questions for you…

            1. Does your Mazda have buttons on the steering wheel? And if so do they send CAN messages when pressed?

            2. From what I can gather, the ECU gets speed readings from all four ABS sensors from the ABS unit. Do you know if you still get a speed reading when only one of the sensors is connected?

          2. Does the Australian version come with 3G / GPS or do you have to get it as a special SKU option? Have you considered the power draw and all? Oh you’re tempting me….

            1)Yes, the buttons I believe wire directly to the CD player on my car. I get the button presses very indirectly via the headunit LCD displays… (Says “VOL x” for example on volume changes)

            2)I’m not sure. There is a separate message where the 4 ABS messages transmitted, so you should at least get that I suppose…

          3. I could only see the options listed via the global site, not the australian one and I think it is a special SKU option. I’m sure I could find one online somewhere.

            Im not too worried about the power draw at this stage as I wont be running all of the electronics from the RX8 so there should be some power left over. If I do have issues I can always use an uprated alternator.

            Bugger about the steering wheel buttons. I was hoping to use them to control the LCD dash via the CAN network, I guess I could still do it with them wired to the laptops keyboard 🙂

            The reason I ask about the ABS is I wont be running the RX8 hubs which have the sensors. I am hoping the ABS computer will still send a speed signal if it gets pulses from a reed switch instead of the hub sensors.

  10. normally CAN at the J1962 connector “uses” pins 6 (CAN H) and 14 (CAN L).
    my USA market 2005 mazda 3 also has pins at 3 and 11. Are these also CAN? (i understand volvo uses pins 3 and 11 for CAN.)

  11. Hi Madox

    Do you have .dbc files for any of the work you have done?

    In particular, I am interested in looking at HS and MS CAN IDs for Ford products in general, ideally for Ford medium-duty trucks (e.g. F450)

    Right now, EEC messages and fuel economy are most important. PLease write back or call to see if we can work together

    Steve

  12. Doing some deep Internet searching on a project I need a guru on. Think it might be related to can-bus but not 100% sure. My motorcycle is a Kawasaki 1400gtr (concours 14 they call it here in the USA). It has an onboard computer which displays it info on a small LCD between the speedo and tach. I want to use a gps mounted in the bike somewhere and have the basic navigation data show up on the LCD. Was hoping to find a way to patch it in or even put an inline switch to the LCD feed where I can toggle between the two sources. And input or interest.

  13. Pingback: Faz Jaxton
  14. Hi,

    First, thank you for your work acievement. This is very helpfull. Second I have a question. the J1962 is the OBD connector of the car ? if yes, you have two bus can on this 500kps and 125 kbps ) ?

    Thanks
    Best regards

    1. Yes. Yes and Yes 🙂
      HS-CAN and MS-CAN as referred to by the service manual.
      MS-CAN is more ‘entertainment’ and HS-CAN is more ‘ECUs and stuff’

  15. Hi Madix, your blog is great. Im trying to build a mp3 player that uses the ead unit controls (steering contros too) and use de head unit LCD to show track, folder, id3, etc. I made the mp3 player using RaspberryPi and mplayer controled via events. Do you have any information about how i can display text on the LCD via CAN messages? Thank you.

    1. If you read the comments above, it is quite tricky to write to the LCD as you have to ‘overwrite’ the data coming from the standard controller. i.e. wait for LCD update message sent by normal controller, quickly send yours to supersede it. I never saw it was worth the effort to pursue it.

  16. Great stuff here! My question would be : how to program or with what to get inside the ecu from a mazda europe CX7 diesel? I do a reaserch for a friend who is willing to help with my car. The keyless entry module has been replaced and still not able to program over OBD anything. Now we want to dissable it. He has a lot of things, with what he can play arround, but he didn’t work before on a Mazda.
    What kind of software we need?… in the case that we want to remove the ecu and connect it to a PC.
    Any info would be great to have, as long as we have no place to start from.
    Thank you .

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.