Mazda CAN Bus

Introduction

Read the multi-part blog posts :-

  1. Reverse Engineering the Mazda CAN Bus – Part 1
  2. Reverse Engineering the Mazda CAN Bus – Part 2

Notes :-

  1. I’ve still got some data from another person on a similar quest to combine into this data… if you have any info/data as well.  Let me know and I’ll add it too.
  2. Ignore my silly colour schemes :)   I think blue is confirmed, and all others…mean something.  I’ll clean it up later.

HS-CAN Data

This is the HS CAN data.  500 kbps / 500kHz.

Can Message Identifier Byte(s) Bit Bitmask Description Comment
00000040 Only lasts when key is first on
00000046 Only lasts when key is first on
00000190 2 6 0×40 Brake Active
00000200 0,1 Unknown Correlates with with 00000200(4,5) & Acceleration
00000200 2,3 Unknown
00000200 4,5 Unknown Correlates with with 00000200(0,1) & Acceleration
00000200 6 7 0×80 Unknown
00000201 0,1 RPM Scale = X rpm.
00000201 2,3 Unknown Offset by 0×4000. Appears to be the ‘delta’ in engine torque? Derivative of rpm? Cumulative returns to zero.
00000201 4,5 Vehicle Speed Scale = X/100 km/h. Unsigned.
00000201 6 Accelerator Pedal Accelerator Position. 200 is fully depressed.
00000205 2 6 0×40 Brake Active
0000020F 2,3 Vehicle Speed Scale = (X-10000)/100 km/h, unsigned (Refer to handle position). Correlates with 0000004B0 wheel speeds.
0000020F 4 6 0×40 Unknown Appears always on
00000211 2 7 0×80 Unknown Appears always on
00000211 4 6 0×40 Unknown Appears always on
00000212 0 7 0×80 Unknown Appears always on
00000212 2 5 0×20 Unknown Appears always on
00000212 3 7 0×80 Unknown Appears always on
00000212 4 4 0×10 Some Dash Warning Light… Off when ignition is off
00000212 4 6 0×40 Some Dash Warning Light… Off when ignition is off
00000228 0 0 0×1 Off (Park) 0×03 appears to be ‘neutral’
00000228 0 1 0×2 Reverse 0×03 appears to be ‘neutral’
00000228 0 2 0×4 Forward (Drive)
00000228 0 3
00000228 0 4 0×10 1st Gear
00000228 0 5 0×20 2nd Gear
00000228 0 6 0×40 3rd Gear
00000228 0 7 0×80 4th Gear
00000228 1 3 0×8 Gear Shift Active for several messages on each gear change.
00000228 1 4 0×10 Unknown Occurred once on a gear change
00000228 1 6 0×40 Something to do with brake pedal
00000228 1 7 0×80 Manual/Triptronic
00000231 0 0 0×1 Unknown Not Brake, but very close…changes not far from brake
00000231 0 1 0×2 Unknown Always appears off
00000231 0 2 0×4 Unknown Always appears off
00000231 0 3 0×8 Unknown Always appears off
00000231 0 4 0×10 1st Gear Reverse = 0xE?
00000231 0 5 0×20 2nd Gear Reverse = 0xE?
00000231 0 6 0×40 3rd Gear Reverse = 0xE?
00000231 0 7 0×80 4th Gear Reverse = 0xE?
00000231 1,2 Unknown Torque? RPM demand x 10?
00000240 0 Unknown Varies, not correlated with speed/accel. Around 10/11/12 when stationary.
00000250 0 Unknown
00000250 1 Unknown
00000250 2 Unknown
00000250 3 Unknown Accelerator Position. 225 seems fully depressed, but bias of 32… See other accel pos. This might be the raw value, some noise.
00000250 4 0 0×1
00000250 5 1 0×2
00000250 5 2 0×4
00000250 5 3 0×8
00000250 5 4 0×10
00000250 5 5 0×20
00000250 5 6 0×40
000002A0 Unknown Appears to be all zeroes (4 byte frame)
00000420 0,1 Unknown
00000420 1
00000420 2 Unknown Counter (Always Increments)
00000430 Unknown Not sure if 2 bytes or byte pair.
00000433 1 0 0×1
00000433 2 0 0×1 Unknown Not seen to change (0)
00000433 2 1 0×2 Unknown Changes
00000433 2 2 0×4 Unknown Changes
00000433 2 3 0×8 Unknown Not seen to change (1)
00000433 2 6 0×40 Unknown Not seen to change (1)
00000433 3 0 0×1 Unknown
00000433 3 1 0×2 Unknown
00000433 3 2 0×4 Unknown
00000433 3 3 0×8 Unknown
00000433 5 0 0×1 Unknown Not seen to change (1)
00000433 6 0 0×1 Unknown
00000433 6 1 0×2 Unknown
00000433 6 2 0×4 Unknown
00000433 6 3 0×8 Unknown
00000433 6 6 0×40 Unknown
000004B0 0,1 Left Front Wheel Speed Check Order. Scale = (X-10000)/100 km/h, unsigned (Refer to handle position). Correlates with 00000020F vehicle speeds.
000004B0 2,3 Right Front Wheel Speed Check Order. Scale = (X-10000)/100 km/h, unsigned (Refer to handle position). Correlates with 00000020F vehicle speeds.
000004B0 4,5 Left Rear Wheel Speed Check Order. Scale = (X-10000)/100 km/h, unsigned (Refer to handle position). Correlates with 00000020F vehicle speeds.
000004B0 6,7 Right Rear Wheel Speed Check Order. Scale = (X-10000)/100 km/h, unsigned (Refer to handle position). Correlates with 00000020F vehicle speeds.
000004DA 0,1 Steering Column Angle (X-32768)/10 Degrees, Clockwise +ve.
000004DA 2 6 0×40 Unknown Not seen to change (1)
000004DA 2 7 0×80 Unknown Not seen to change (1)
000004EA Unknown 1 Byte Frame always 00
000004EC Unknown 8 Byte Frame always 00
000004F0 Unchanging Unknown Every 5s 14 24 12 FF FF 7F
000004F1 Unchanging Unknown Every 5s 4A 01 9F FF FF 64 5E 5E
000004F2 1,2 Odometer (Total) Might be first byte too to get the range
000004F3 Unchanging Unknown Every 5s 32 30 33 30 30 38 31 31
000004F4 Unchanging Unknown Every 5s 42 4B 31 30 46 32 30 30

MS CAN Data

This is the MS CAN data. 125 kbps / 125 kHz.

Can Message Identifier Byte(s) Bit Bitmask Description Comment
00000023 1 7 0×80 Unknown Not seen to change (1)
00000201 0,1 RPM
00000201 2,3 Unknown Offset by 0×8000. Appears to be the ‘delta’ in engine torque? Cumulative returns to zero.
00000201 4,5 Vehicle Speed Scale = X/100 km/h. Unsigned.
00000201 6 Unknown Accelerator Position? Very closely linked with accelerations (not decel).
00000265 0 5 0×20 Unknown Left Blinker – Indicates light on. (It pulses too!) Check hazard
00000265 0 6 0×40 Unknown Right Blinker – Indicates light on. (It pulses too!) Check hazard
00000285 0 5 0×20 Unknown key pos?
00000285 0 6 0×40 Unknown key pos?
0000028F 0 4 0×10 Unknown volume?
0000028F 0 6 0×40 Unknown volume?
0000028F 0 7 0×80 Unknown volume?
00000290 1,2,3,4,5,6,7 HU LCD Alphanumeric Display 1/2 ASCII Byte Codes
00000291 1,2,3,4,5,6,7 HU LCD Alphanumeric Display 2/2 ASCII Byte Codes
00000400 0,1 Average Speed Average Speed in Km/h. Might be single byte only
00000400 2,3 Fuel Consumption Instantaneous Fuel Consumption L/100km. Scale X/10.
00000400 3,4 Average Fuel Consumption Fuel Consumption (L) per 100km. Scale X/10. Might be single byte only.
00000400 5,6 Distance Remaining Distance in KM remaining
00000401 0 Unknown Not seen to change (0)
00000420 0 Unknown Rises then levels off…Temperature?
00000420 1,2 Unknown Increasing counter?
00000420 4 1 0×2 Unknown
00000420 4 6 0×40 Unknown
00000433 2 Guess only, temperature in C X/4 (0.25deg C incs)
00000433 3 0 0×1 Key On?
00000433 3 3 0×8 Air Con running?
00000433 3 6 0×40 Highbeam (Indicator Light)
00000433 4 Headlight & Wiper
00000460 Key position?
00000501 Key?
00000511 Key?
http://www.madox.net/blog/2009/10/24/reverse-engineering-the-mazda-can-bus-%e2%80%93-part-2/

28 Responses to “Mazda CAN Bus”
  1. serg says:
    May 5, 2009 at 4:44 pm

    hello! thank’s a lot for this information. i have a question regarding CAN terminology – what is the difference between kHz and kbps? Why kbps is one half of kHz? I read the datasheet for MCP2515 (Microchip CAN controller) – they talk about kHz only…
    Do you know what message id is responsible for controlling left part of the LCD – clock/avg speed/instatnd fuel cons/avg fuel cons/distance remaining?

    Reply
  2. Madox says:
    May 6, 2009 at 3:15 am

    I made a boo-boo :) Edit – Boo-boo and a couple of other typos corrected!

    There is no difference in kHz vs kbps, they should be identical as CAN bus uses NRZ encoding.
    kbps would be half of kHz in say Manchester encoding.

    Message 00000400 as per the table above shows the trip computer information such as fuel consumption etc etc!

    Reply
  3. SilverGhost says:
    June 9, 2009 at 11:37 pm

    Hello, thanks for this info.

    I’m currently trying to find a way to use the H/U Alphanumeric LCD screen on a Mazda 6 for my own purposes … Sending messages on the bus to display something shall be trivial.

    However, I don’t know how I can manage to have the HU stop outputting these messages in order not to mess with mine.

    I can of course cut the H/U of the CAN bus, but I don’t like this idea, cause it might be used for some other things.

    Does anyone have a greater idea ?

    See you ;)

    Reply
  4. Gabriel Radulescu says:
    June 30, 2009 at 9:21 pm

    You can send the 3 frames with the following IDs:
    0×28F: LCD settings and probably some other settings (you just send the same data you receive in a normal 0×28f frame).
    0×290: 0xC0 (first byte) followed by first 5 alfanum signs
    0×291: 0×85 (first byte) followed by the next 7 alfanum signs

    all of them, just after you receive the 0×291 frame id sent by the HU. This will make your text being visible with almost no flicker at all.
    The reason for sending the 0×28F is that it is required for displaying the 0×290 and 0×291 text, otherwise the LCD seems to simply ignore the 0×290 and 0×291.
    Another method would be to set a timer with a 150ms interrupt and send the 3 frames described above.

    You can contact me on my email because I am also working on displaying the fuel consumption for Mazda 3 CE 1.6i 2008 (on the 2008 version you cannot enable the computer like for the 2006 and older models).

    Reply
  5. Gabriel Radulescu says:
    June 30, 2009 at 9:25 pm

    0×28F frame content that I have used:
    hex: D1 00 00 00 80 00 00 01

    my email: gaby.radulescu@gmail.com

    Reply
    • Gabriel Radulescu says:
      June 30, 2009 at 9:35 pm

      I have another problem:
      I am using a PIC18F458 with integrated CAN controller and a MCP2551 CAN tranceiver, 16 MHz oscillator (with High Speed no PLL), 124 Ohm between CAN H & CAN-L, + about 1m of cable.
      On CAN – MS 125Kbps:
      For some reason I cannot receive any frame after about 3-4 seconds, but the transmission works fine (with the application above). Last time when I checked there were a lot of error interrupts for reception.
      The baud configuration is the following:
      BRGCON1.BRP = 7
      BRGCON1.SJW = 0
      BRGCON2.PRSEG = 0
      BRGCON2.SEG1PH = 2
      BRGCON2.SAM = 0 (sampled once)
      BRGCON2.SEG2PHTS = 1 (segment 2 phase freely programable)
      BRGCON3.SEG2PH = 2 (phase of segment 2)
      BRGCON3.WAKFIL = false

      Has anyone good settings for CAN on either speed. There might be some other reason for losing the communication after 3 seconds, some other settings.

      Gaby
      gaby.radulescu at gmail.com

      Reply
  6. Madox.NET » EasySync USB-CAN Bus Adapter – Works great in Ubuntu after some fiddling says:
    June 30, 2009 at 10:52 pm

    [...] Mazda CAN Bus [...]

    Reply
    • Hex says:
      July 12, 2009 at 1:07 am

      Could you explain this CAN message identifiers? Are they really CAN or it’s KWP2000 оr J1979?

      Reply
      • Madox says:
        July 12, 2009 at 8:59 am

        Its really CAN as active on the car without any J1979 or other queries etc.

        The CAN adapter was set to ‘listen’ mode to sniff what occurs on the car normally without diagnostic messages flying back and forth.

        Reply
  7. Ed Preston says:
    July 18, 2009 at 7:50 am

    Hi,
    Wonder if you can help me, some great info here on your site.
    I’m building a kit car at the moment and looking to use some late Mazda instruments, maybe from an MX5/Miata or a Mazda 3 or 6, however I think these are all CAN bus, how difficult would it be to make them work with standard analogue signals, do you know?

    Thanks

    Reply
    • Madox says:
      July 18, 2009 at 8:31 pm

      Hi Ed,

      I actually doubt they’re CAN Bus, and would presume the actual instruments are analog or digital devices.

      This is my assumption only but I believe the instrument panel on the Mazda’s are driven by a CAN bus controller gateway rather than each instrument having a CAN controller individually. Have you got one you can tinker with?

      Why not just get some other instrument gauges or even a microcontroller with a screen to use as well? I was really tempted by this one :)
      http://www.4dsystems.com.au/prod.php?id=33
      http://www.4dsystems.com.au/prod.php?id=34
      (Might be a bit small) A few of these would make an interesting instrument panel I’ll say.

      Reply
  8. Jim Boemler says:
    July 19, 2009 at 8:33 pm

    Ed is right, the instruments (on the 2006+ MX-5 at least) are almost entirely driven from CAN. The car’s ECU takes the analog inputs, and I suspect the needles are driven by stepper motors (not verified yet, since I haven’t had my cluster apart yet).

    BTW, I have an earlier version of the 4D systems display (128×128), driven by a custom Propeller-based board. Nice bright high-contrast display, and should work nicely in the car. I was building a fuel gauge for a race car, but so far I haven’t tried it in the car. I was planning to use the same display to replace the totally-fake “oil pressure” gauge in the MX-5.

    Reply
  9. Madox says:
    July 19, 2009 at 11:27 pm

    Hi Jim,

    What I meant was even though the instrument cluster itself is CAN bus, there is only one master controller on it. Each of the individual instruments themselves are probably analog or stepper gauges as you mentioned.

    The only thing to watch out on the OLED displays is managing the lifetime of the colours…

    Reply
  10. Jim Boemler says:
    July 20, 2009 at 7:14 am

    Actually the big problem with the 4D OLEDs is managing power. If you drop power to the external controller and the display at the same time, the display fails in short order. So I had to build a hardware/software power management system to be sure the display is powered down for a little while before the controller powers down. It’s a serious weak spot in at least the early displays like mine; perhaps they’ve designed around it in later models.

    Reply
  11. Hex says:
    August 8, 2009 at 6:44 pm

    Hi Madox,

    I’ve been trying to understand how ECU programming for Mazda is made and got absolutely confused. Maybe you can explain what it’s all about.

    Here’s my quest:
    Mazda says that J2534 can be used for ECU/ECM/PCM programming:
    http://www.mazdatechinfo.com/home/ecmDetail.asp
    And even gives the list of hardware validated by Mazda. Each of them costs about 2000$. Looks like conspiracy to me :)

    First of all I’ve found the information about J2534 passthru devices here:
    http://www.drewtech.com/support/j2534/intro.html
    They say “A J2534 device plugs into a cars’ OBD connector on one side, and a computer on the other side. These devices are not made by car manufacturers, but by any company that sees an opportunity. Under the hood, the device must speak a myriad of different vehicle protocols (ISO9141, J1850VPW/PWM, CAN, etc.) used by the different manufacturers.”
    This SAE J2534 standard is just a set of API, which hardware manufacturers should implement if they want their hardware to be used by car service software, which is based on J2534 API. (Just like NDIS for network cards)
    The example is Tactrix Openport:
    http://www.tactrix.com/product_info.php?cPath=22&products_id=49&osCsid=b635484bda09c8993a1c286b53b3dd72
    it’s a device that is able to communicate ISO9141(Kline/Kwp2000), ISO15765(CAN), J1850.
    Tactrix Openport hardware is connected to PC via FTDI chip, just like many other diagnostic hardware. Plus they have op20pt32.dll which implements J2534 interface. I.e. this dll exports a set of function with names “PassThru*” but actually sends commands to FTDI chip.

    I’ve looked at the logs of flash programming sessions made by EcuFlash:
    http://forums.openecu.org/viewtopic.php?f=15&t=4135&sid=3b05ab66d6840e66ec2cbdf623e58eb9
    Quote:
    [2208] PassThruConnect(DeviceID=1,ProtocolID=3,Flags=00000200,Baudrate=4800,pChannelID=@094F119C)
    ProtocolID=3 means ISO9141

    So it seems like everything you need is to be able to communicate via ISO9141, and you’ll be able to flash the ECU over OBD-II socket.

    Next thing I wondered was the difference betweed the Scan tools and the Flash tools. I have ELM327 scantool. Which is also able to communicate “a myriad of different vehicle protocols (ISO9141, J1850VPW/PWM, CAN, etc.)”. But on some reason there’s no software that uses it for flashing. WHY???

    I’ve tried to ask ELM Electronics about it.

    Me: According to ELM 327 documentation it supports all the ODB-II interfaces.
    So, it should be able to work as SAE J2534 pass-thru device.
    Is there j2534 API DLL for ELM devices?

    Elm: The ELM327 does not support J2534 pass-thru.

    Me: Is it a hardware or software incompatibility?

    Elm: It is a design decision that we do not plan to support J2534, with the hardware and the software.

    What is so magical about J2534 hardware, if it’s actually a set of API which just knows what to send over which of OBD-II protocol? Why can’t scan tools do the flash programming?

    Reply
    • Hex says:
      August 16, 2009 at 11:26 pm

      The answer is found. Scantool is unable to set the programming voltage, that’s why it can’t be used actually. Never the less, J2534 is not a must tool for flashing. Old mazda cars, which used ISO9141, can be programmed via Openport 1.3. The schematics can be found at openecu.org. The new cars are flashed over CAN. But connecting to CAN pins at OBD-II plug is not enough. There’s some magic that should be done about setting the voltage on ECU pins.

      Reply
  12. LoneStar says:
    August 17, 2009 at 2:28 am

    Does this information apply to Mazda2?

    Reply
  13. Jim Boemler says:
    August 19, 2009 at 6:25 pm

    Programming voltage may be needed for some applications, but it doesn’t appear to be universal. The Mazda MX-5 (2006 specifically) doesn’t have provision for voltage to be supplied from the J2534 device — there’s no separate wire to the ECU, and the power pin is hard-wired to the battery. As far as I can tell the programming is done entirely via CAN frames.

    Reply
  14. Jim Boemler says:
    August 20, 2009 at 7:37 pm

    I’ve recently had a Mazda MX5 ECU apart, helping do some reverse engineering of it. First installment of info is on my blog at http://clownspeed.com/?p=116 for anyone interested.

    Reply
  15. Borden says:
    September 1, 2009 at 5:19 am

    Hello Madox, I’ve reversed my Mazda6 2003 2.3NA CAN recently, compare to your Mazda3, there’s much less info on the bus cause my car is older. It only has CAN ID 200, 201, 210, 211, 215, 216, 231, 240, 420, 430, 4b0, 4c0, 4c1, 620 and 630. It has no what called “trip computer” info, but I’ve discovered some other useful info, like DSC switch condition, MIL light condition, coolant temperature, calculated engine load, fuel injection amount….But your this list gives me many ideas to dig it deeper! thanks alot!

    Reply
  16. Jerry says:
    September 5, 2009 at 3:40 am

    Hey guys,

    What software packages do you recommend I use to tap into the CAN Bus? My Vaio runs windows 7 and it would be preferred, but I’m proficient with any UNIX OS and can use that as a last resort. Once I tap into the bus, will crafting a packet with the information detailed above TRIGGER the system, or is the information above simply so I know what I’m looking at when I see the packet come across my terminal? IE: If I wanted to re-create the “INFO” button on my headunit and trigger the fuel computer to show fuel remaining, would I simply create a packet with Message ID 00000400 that’s 5-6 bytes in size? If not, how would I trigger the system? My goal is to reproduce the “INFO” button via computer.

    Reply
    • Madox says:
      September 20, 2009 at 12:43 am

      The message is constantly being transmitted on the CAN Bus, all you’ll have to do is sniff in and parse the information to be displayed. Even I have a paranoid side and having the device on ‘listen mode’ only makes me feel a bit better that I’m not screwing with the car while I’m driving it. Want to see my stupid rush job php script? :) [Which should work in Windows too...]

      Reply
  17. Jerry says:
    September 21, 2009 at 6:58 pm

    Let’s see it =) Can’t be worse than the hacked main.c I’m tearing apart. (Building a linux cli tool based on CANUSB’s linux driver)

    Reply
    • Madox says:
      October 18, 2009 at 10:39 pm

      Yes it can be :) The EasySync USB-CAN device is a bit too slow to be able to ‘override’ the HU unit display. All I got was flickering between the original and what I want to display…eek… need a microprocecessor to do the headunit override…

      On the plus side, I’m back! :) Haxe/php code on http://mchumby.googlecode.com/

      Reply
      • Matt Jackson says:
        October 31, 2009 at 12:37 pm

        From my own testing, the flicker is due to the fact that you are not stopping the radios HU text being displayed, but just setting your own text. The LCD receives both commands (yours and the radios) and thus it will always flicker due to it changing. I was able to send the command fast enough so only my text was displayed and the flicker was next to non, the issue I encountered though was that the Radio stopped sending and more text to the LCD. It seems it detected something else was sending text commands and so it would stop. This then was no good as there was no way to stop sending my text and have the radio text re-displayed. You would need to design a pcb that sits in-between the radio and the lcd and only send radio text commands through if your not setting your own text.

        Reply
  18. BW says:
    November 17, 2009 at 6:21 am

    Madox,

    good info here. i have an 08 Mazda3 that i want to pull the codes from the EHPAS power steering controller that is on the CAN network. Were you able to pull codes from other controller in the car?Thanks

    Reply
    • Madox says:
      November 17, 2009 at 6:50 am

      Hi, which other controller are you referring to?
      I did get the steering wheel position, one might assume that is from/to the steering controller.

      Reply
  19. BW says:
    November 17, 2009 at 8:06 am

    Hello Madox,

    It is the power steering pump controller (EHPAS System). It is physically under the front right heatlight inside the power steering pump. The dealer pulled up 2 codes B1318 – Battery voltage low and C1278 steering wheel angle fault. I am unable to see these code with a regular handheld emission OBD2 scanner. I am trying to get a scanner that can communicate with the controller. See link to someone in your next of the woods that is trying to mimic this controller

    http://www.oz-clubbies.com/forums/index.php?showtopic=5883&st=0&p=54494&#entry54494

    Most commercial software that can read this cost in the next of $260. What sofware are you using?

    Reply
  20.  
Leave a Reply