Mazda CAN Bus

Introduction

Read the multi-part blog posts :-

  1. Reverse Engineering the Mazda CAN Bus – Part 1
  2. Reverse Engineering the Mazda CAN Bus – Part 2

Notes :-

  1. I’ve still got some data from another person on a similar quest to combine into this data… if you have any info/data as well.ย  Let me know and I’ll add it too.
  2. Ignore my silly colour schemes ๐Ÿ™‚ย  I think blue is confirmed, and all others…mean something.ย  I’ll clean it up later.

HS-CAN Data

This is the HS CAN data.ย  500 kbps / 500kHz.

Can Message Identifier Byte(s) Bit Bitmask Description Comment
00000040 Only lasts when key is first on
00000046 Only lasts when key is first on
00000190 2 6 0x40 Brake Active
00000200 0,1 Unknown Correlates with with 00000200(4,5) & Acceleration
00000200 2,3 Unknown
00000200 4,5 Unknown Correlates with with 00000200(0,1) & Acceleration
00000200 6 7 0x80 Unknown
00000201 0,1 RPM Scale = X rpm.
00000201 2,3 Unknown Offset by 0x4000. Appears to be the ‘delta’ in engine torque? Derivative of rpm? Cumulative returns to zero.
00000201 4,5 Vehicle Speed Scale = X/100 km/h. Unsigned.
00000201 6 Accelerator Pedal Accelerator Position. 200 is fully depressed.
00000205 2 6 0x40 Brake Active
0000020F 2,3 Vehicle Speed Scale = (X-10000)/100 km/h, unsigned (Refer to handle position). Correlates with 0000004B0 wheel speeds.
0000020F 4 6 0x40 Unknown Appears always on
00000211 2 7 0x80 Unknown Appears always on
00000211 4 6 0x40 Unknown Appears always on
00000212 0 7 0x80 Unknown Appears always on
00000212 2 5 0x20 Unknown Appears always on
00000212 3 7 0x80 Unknown Appears always on
00000212 4 4 0x10 Some Dash Warning Light… Off when ignition is off
00000212 4 6 0x40 Some Dash Warning Light… Off when ignition is off
00000228 0 0 0x1 Off (Park) 0x03 appears to be ‘neutral’
00000228 0 1 0x2 Reverse 0x03 appears to be ‘neutral’
00000228 0 2 0x4 Forward (Drive)
00000228 0 3
00000228 0 4 0x10 1st Gear
00000228 0 5 0x20 2nd Gear
00000228 0 6 0x40 3rd Gear
00000228 0 7 0x80 4th Gear
00000228 1 3 0x8 Gear Shift Active for several messages on each gear change.
00000228 1 4 0x10 Unknown Occurred once on a gear change
00000228 1 6 0x40 Something to do with brake pedal
00000228 1 7 0x80 Manual/Triptronic
00000231 0 0 0x1 Unknown Not Brake, but very close…changes not far from brake
00000231 0 1 0x2 Unknown Always appears off
00000231 0 2 0x4 Unknown Always appears off
00000231 0 3 0x8 Unknown Always appears off
00000231 0 4 0x10 1st Gear Reverse = 0xE?
00000231 0 5 0x20 2nd Gear Reverse = 0xE?
00000231 0 6 0x40 3rd Gear Reverse = 0xE?
00000231 0 7 0x80 4th Gear Reverse = 0xE?
00000231 1,2 Unknown Torque? RPM demand x 10?
00000240 0 Unknown Varies, not correlated with speed/accel. Around 10/11/12 when stationary.
00000250 0 Unknown
00000250 1 Unknown
00000250 2 Unknown
00000250 3 Unknown Accelerator Position. 225 seems fully depressed, but bias of 32โ€ฆ See other accel pos. This might be the raw value, some noise.
00000250 4 0 0x1
00000250 5 1 0x2
00000250 5 2 0x4
00000250 5 3 0x8
00000250 5 4 0x10
00000250 5 5 0x20
00000250 5 6 0x40
000002A0 Unknown Appears to be all zeroes (4 byte frame)
00000420 0,1 Unknown
00000420 1
00000420 2 Unknown Counter (Always Increments)
00000430 Unknown Not sure if 2 bytes or byte pair.
00000433 1 0 0x1
00000433 2 0 0x1 Unknown Not seen to change (0)
00000433 2 1 0x2 Unknown Changes
00000433 2 2 0x4 Unknown Changes
00000433 2 3 0x8 Unknown Not seen to change (1)
00000433 2 6 0x40 Unknown Not seen to change (1)
00000433 3 0 0x1 Unknown
00000433 3 1 0x2 Unknown
00000433 3 2 0x4 Unknown
00000433 3 3 0x8 Unknown
00000433 5 0 0x1 Unknown Not seen to change (1)
00000433 6 0 0x1 Unknown
00000433 6 1 0x2 Unknown
00000433 6 2 0x4 Unknown
00000433 6 3 0x8 Unknown
00000433 6 6 0x40 Unknown
000004B0 0,1 Left Front Wheel Speed Check Order. Scale = (X-10000)/100 km/h, unsigned (Refer to handle position). Correlates with 00000020F vehicle speeds.
000004B0 2,3 Right Front Wheel Speed Check Order. Scale = (X-10000)/100 km/h, unsigned (Refer to handle position). Correlates with 00000020F vehicle speeds.
000004B0 4,5 Left Rear Wheel Speed Check Order. Scale = (X-10000)/100 km/h, unsigned (Refer to handle position). Correlates with 00000020F vehicle speeds.
000004B0 6,7 Right Rear Wheel Speed Check Order. Scale = (X-10000)/100 km/h, unsigned (Refer to handle position). Correlates with 00000020F vehicle speeds.
000004DA 0,1 Steering Column Angle (X-32768)/10 Degrees, Clockwise +ve.
000004DA 2 6 0x40 Unknown Not seen to change (1)
000004DA 2 7 0x80 Unknown Not seen to change (1)
000004EA Unknown 1 Byte Frame always 00
000004EC Unknown 8 Byte Frame always 00
000004F0 Unchanging Unknown Every 5s 14 24 12 FF FF 7F
000004F1 Unchanging Unknown Every 5s 4A 01 9F FF FF 64 5E 5E
000004F2 1,2 Odometer (Total) Might be first byte too to get the range
000004F3 Unchanging Unknown Every 5s 32 30 33 30 30 38 31 31
000004F4 Unchanging Unknown Every 5s 42 4B 31 30 46 32 30 30

MS CAN Data

This is the MS CAN data. 125 kbps / 125 kHz.

Can Message Identifier Byte(s) Bit Bitmask Description Comment
00000023 1 7 0x80 Unknown Not seen to change (1)
00000201 0,1 RPM
00000201 2,3 Unknown Offset by 0x8000. Appears to be the ‘delta’ in engine torque? Cumulative returns to zero.
00000201 4,5 Vehicle Speed Scale = X/100 km/h. Unsigned.
00000201 6 Unknown Accelerator Position? Very closely linked with accelerations (not decel).
00000265 0 5 0x20 Unknown Left Blinker โ€“ Indicates light on. (It pulses too!) Check hazard
00000265 0 6 0x40 Unknown Right Blinker โ€“ Indicates light on. (It pulses too!) Check hazard
00000285 0 5 0x20 Unknown key pos?
00000285 0 6 0x40 Unknown key pos?
0000028F 0 4 0x10 Unknown volume?
0000028F 0 6 0x40 Unknown volume?
0000028F 0 7 0x80 Unknown volume?
00000290 1,2,3,4,5,6,7 HU LCD Alphanumeric Display 1/2 ASCII Byte Codes
00000291 1,2,3,4,5,6,7 HU LCD Alphanumeric Display 2/2 ASCII Byte Codes
00000400 0,1 Average Speed Average Speed in Km/h. Might be single byte only
00000400 2,3 Fuel Consumption Instantaneous Fuel Consumption L/100km. Scale X/10.
00000400 3,4 Average Fuel Consumption Fuel Consumption (L) per 100km. Scale X/10. Might be single byte only.
00000400 5,6 Distance Remaining Distance in KM remaining
00000401 0 Unknown Not seen to change (0)
00000420 0 Unknown Rises then levels off…Temperature?
00000420 1,2 Unknown Increasing counter?
00000420 4 1 0x2 Unknown
00000420 4 6 0x40 Unknown
00000433 2 Guess only, temperature in C X/4 (0.25deg C incs)
00000433 3 0 0x1 Key On?
00000433 3 3 0x8 Air Con running?
00000433 3 6 0x40 Highbeam (Indicator Light)
00000433 4 Headlight & Wiper
00000460 Key position?
00000501 Key?
00000511 Key?
http://www.madox.net/blog/2009/10/24/reverse-engineering-the-mazda-can-bus-%e2%80%93-part-2/

115 thoughts on “Mazda CAN Bus”

  1. hello! thank’s a lot for this information. i have a question regarding CAN terminology – what is the difference between kHz and kbps? Why kbps is one half of kHz? I read the datasheet for MCP2515 (Microchip CAN controller) – they talk about kHz only…
    Do you know what message id is responsible for controlling left part of the LCD – clock/avg speed/instatnd fuel cons/avg fuel cons/distance remaining?

  2. I made a boo-boo ๐Ÿ™‚ Edit – Boo-boo and a couple of other typos corrected!

    There is no difference in kHz vs kbps, they should be identical as CAN bus uses NRZ encoding.
    kbps would be half of kHz in say Manchester encoding.

    Message 00000400 as per the table above shows the trip computer information such as fuel consumption etc etc!

  3. Hello, thanks for this info.

    I’m currently trying to find a way to use the H/U Alphanumeric LCD screen on a Mazda 6 for my own purposes … Sending messages on the bus to display something shall be trivial.

    However, I don’t know how I can manage to have the HU stop outputting these messages in order not to mess with mine.

    I can of course cut the H/U of the CAN bus, but I don’t like this idea, cause it might be used for some other things.

    Does anyone have a greater idea ?

    See you ๐Ÿ˜‰

  4. You can send the 3 frames with the following IDs:
    0x28F: LCD settings and probably some other settings (you just send the same data you receive in a normal 0x28f frame).
    0x290: 0xC0 (first byte) followed by first 5 alfanum signs
    0x291: 0x85 (first byte) followed by the next 7 alfanum signs

    all of them, just after you receive the 0x291 frame id sent by the HU. This will make your text being visible with almost no flicker at all.
    The reason for sending the 0x28F is that it is required for displaying the 0x290 and 0x291 text, otherwise the LCD seems to simply ignore the 0x290 and 0x291.
    Another method would be to set a timer with a 150ms interrupt and send the 3 frames described above.

    You can contact me on my email because I am also working on displaying the fuel consumption for Mazda 3 CE 1.6i 2008 (on the 2008 version you cannot enable the computer like for the 2006 and older models).

    1. I have another problem:
      I am using a PIC18F458 with integrated CAN controller and a MCP2551 CAN tranceiver, 16 MHz oscillator (with High Speed no PLL), 124 Ohm between CAN H & CAN-L, + about 1m of cable.
      On CAN – MS 125Kbps:
      For some reason I cannot receive any frame after about 3-4 seconds, but the transmission works fine (with the application above). Last time when I checked there were a lot of error interrupts for reception.
      The baud configuration is the following:
      BRGCON1.BRP = 7
      BRGCON1.SJW = 0
      BRGCON2.PRSEG = 0
      BRGCON2.SEG1PH = 2
      BRGCON2.SAM = 0 (sampled once)
      BRGCON2.SEG2PHTS = 1 (segment 2 phase freely programable)
      BRGCON3.SEG2PH = 2 (phase of segment 2)
      BRGCON3.WAKFIL = false

      Has anyone good settings for CAN on either speed. There might be some other reason for losing the communication after 3 seconds, some other settings.

      Gaby
      gaby.radulescu at gmail.com

      1. Its really CAN as active on the car without any J1979 or other queries etc.

        The CAN adapter was set to ‘listen’ mode to sniff what occurs on the car normally without diagnostic messages flying back and forth.

  5. Hi,
    Wonder if you can help me, some great info here on your site.
    I’m building a kit car at the moment and looking to use some late Mazda instruments, maybe from an MX5/Miata or a Mazda 3 or 6, however I think these are all CAN bus, how difficult would it be to make them work with standard analogue signals, do you know?

    Thanks

    1. Hi Ed,

      I actually doubt they’re CAN Bus, and would presume the actual instruments are analog or digital devices.

      This is my assumption only but I believe the instrument panel on the Mazda’s are driven by a CAN bus controller gateway rather than each instrument having a CAN controller individually. Have you got one you can tinker with?

      Why not just get some other instrument gauges or even a microcontroller with a screen to use as well? I was really tempted by this one ๐Ÿ™‚
      http://www.4dsystems.com.au/prod.php?id=33
      http://www.4dsystems.com.au/prod.php?id=34
      (Might be a bit small) A few of these would make an interesting instrument panel I’ll say.

    2. Having looked into the RX-8, some of the functions (eg fuel) are non-CAN but speed/rpm and most of the warning lights are CAN.

      You could fairly easily rig up something to translate a ‘classic’ sensor or two into a CAN signal, eg an arduino with the Spark-fun shield or (if you don’t mind some soldering) a cheaper CAN shield from here http://www.fazjaxton.net/products/canshield/

  6. Ed is right, the instruments (on the 2006+ MX-5 at least) are almost entirely driven from CAN. The car’s ECU takes the analog inputs, and I suspect the needles are driven by stepper motors (not verified yet, since I haven’t had my cluster apart yet).

    BTW, I have an earlier version of the 4D systems display (128×128), driven by a custom Propeller-based board. Nice bright high-contrast display, and should work nicely in the car. I was building a fuel gauge for a race car, but so far I haven’t tried it in the car. I was planning to use the same display to replace the totally-fake “oil pressure” gauge in the MX-5.

  7. Hi Jim,

    What I meant was even though the instrument cluster itself is CAN bus, there is only one master controller on it. Each of the individual instruments themselves are probably analog or stepper gauges as you mentioned.

    The only thing to watch out on the OLED displays is managing the lifetime of the colours…

  8. Actually the big problem with the 4D OLEDs is managing power. If you drop power to the external controller and the display at the same time, the display fails in short order. So I had to build a hardware/software power management system to be sure the display is powered down for a little while before the controller powers down. It’s a serious weak spot in at least the early displays like mine; perhaps they’ve designed around it in later models.

  9. Hi Madox,

    I’ve been trying to understand how ECU programming for Mazda is made and got absolutely confused. Maybe you can explain what it’s all about.

    Here’s my quest:
    Mazda says that J2534 can be used for ECU/ECM/PCM programming:
    http://www.mazdatechinfo.com/home/ecmDetail.asp
    And even gives the list of hardware validated by Mazda. Each of them costs about 2000$. Looks like conspiracy to me ๐Ÿ™‚

    First of all I’ve found the information about J2534 passthru devices here:
    http://www.drewtech.com/support/j2534/intro.html
    They say “A J2534 device plugs into a cars’ OBD connector on one side, and a computer on the other side. These devices are not made by car manufacturers, but by any company that sees an opportunity. Under the hood, the device must speak a myriad of different vehicle protocols (ISO9141, J1850VPW/PWM, CAN, etc.) used by the different manufacturers.”
    This SAE J2534 standard is just a set of API, which hardware manufacturers should implement if they want their hardware to be used by car service software, which is based on J2534 API. (Just like NDIS for network cards)
    The example is Tactrix Openport:
    http://www.tactrix.com/product_info.php?cPath=22&products_id=49&osCsid=b635484bda09c8993a1c286b53b3dd72
    it’s a device that is able to communicate ISO9141(Kline/Kwp2000), ISO15765(CAN), J1850.
    Tactrix Openport hardware is connected to PC via FTDI chip, just like many other diagnostic hardware. Plus they have op20pt32.dll which implements J2534 interface. I.e. this dll exports a set of function with names “PassThru*” but actually sends commands to FTDI chip.

    I’ve looked at the logs of flash programming sessions made by EcuFlash:
    http://forums.openecu.org/viewtopic.php?f=15&t=4135&sid=3b05ab66d6840e66ec2cbdf623e58eb9
    Quote:
    [2208] PassThruConnect(DeviceID=1,ProtocolID=3,Flags=00000200,Baudrate=4800,pChannelID=@094F119C)
    ProtocolID=3 means ISO9141

    So it seems like everything you need is to be able to communicate via ISO9141, and you’ll be able to flash the ECU over OBD-II socket.

    Next thing I wondered was the difference betweed the Scan tools and the Flash tools. I have ELM327 scantool. Which is also able to communicate “a myriad of different vehicle protocols (ISO9141, J1850VPW/PWM, CAN, etc.)”. But on some reason there’s no software that uses it for flashing. WHY???

    I’ve tried to ask ELM Electronics about it.

    Me: According to ELM 327 documentation it supports all the ODB-II interfaces.
    So, it should be able to work as SAE J2534 pass-thru device.
    Is there j2534 API DLL for ELM devices?

    Elm: The ELM327 does not support J2534 pass-thru.

    Me: Is it a hardware or software incompatibility?

    Elm: It is a design decision that we do not plan to support J2534, with the hardware and the software.

    What is so magical about J2534 hardware, if it’s actually a set of API which just knows what to send over which of OBD-II protocol? Why can’t scan tools do the flash programming?

    1. The answer is found. Scantool is unable to set the programming voltage, that’s why it can’t be used actually. Never the less, J2534 is not a must tool for flashing. Old mazda cars, which used ISO9141, can be programmed via Openport 1.3. The schematics can be found at openecu.org. The new cars are flashed over CAN. But connecting to CAN pins at OBD-II plug is not enough. There’s some magic that should be done about setting the voltage on ECU pins.

  10. Programming voltage may be needed for some applications, but it doesn’t appear to be universal. The Mazda MX-5 (2006 specifically) doesn’t have provision for voltage to be supplied from the J2534 device — there’s no separate wire to the ECU, and the power pin is hard-wired to the battery. As far as I can tell the programming is done entirely via CAN frames.

  11. Hello Madox, I’ve reversed my Mazda6 2003 2.3NA CAN recently, compare to your Mazda3, there’s much less info on the bus cause my car is older. It only has CAN ID 200, 201, 210, 211, 215, 216, 231, 240, 420, 430, 4b0, 4c0, 4c1, 620 and 630. It has no what called “trip computer” info, but I’ve discovered some other useful info, like DSC switch condition, MIL light condition, coolant temperature, calculated engine load, fuel injection amount….But your this list gives me many ideas to dig it deeper! thanks alot!

  12. Hey guys,

    What software packages do you recommend I use to tap into the CAN Bus? My Vaio runs windows 7 and it would be preferred, but I’m proficient with any UNIX OS and can use that as a last resort. Once I tap into the bus, will crafting a packet with the information detailed above TRIGGER the system, or is the information above simply so I know what I’m looking at when I see the packet come across my terminal? IE: If I wanted to re-create the “INFO” button on my headunit and trigger the fuel computer to show fuel remaining, would I simply create a packet with Message ID 00000400 that’s 5-6 bytes in size? If not, how would I trigger the system? My goal is to reproduce the “INFO” button via computer.

    1. The message is constantly being transmitted on the CAN Bus, all you’ll have to do is sniff in and parse the information to be displayed. Even I have a paranoid side and having the device on ‘listen mode’ only makes me feel a bit better that I’m not screwing with the car while I’m driving it. Want to see my stupid rush job php script? ๐Ÿ™‚ [Which should work in Windows too…]

  13. Let’s see it =) Can’t be worse than the hacked main.c I’m tearing apart. (Building a linux cli tool based on CANUSB’s linux driver)

    1. Yes it can be ๐Ÿ™‚ The EasySync USB-CAN device is a bit too slow to be able to ‘override’ the HU unit display. All I got was flickering between the original and what I want to display…eek… need a microprocecessor to do the headunit override…

      On the plus side, I’m back! ๐Ÿ™‚ Haxe/php code on http://mchumby.googlecode.com/

      1. From my own testing, the flicker is due to the fact that you are not stopping the radios HU text being displayed, but just setting your own text. The LCD receives both commands (yours and the radios) and thus it will always flicker due to it changing. I was able to send the command fast enough so only my text was displayed and the flicker was next to non, the issue I encountered though was that the Radio stopped sending and more text to the LCD. It seems it detected something else was sending text commands and so it would stop. This then was no good as there was no way to stop sending my text and have the radio text re-displayed. You would need to design a pcb that sits in-between the radio and the lcd and only send radio text commands through if your not setting your own text.

        1. Might have something to do with the CAN standard. If you look at this: http://www.keil.com/download/files/can_primer_2009sp.pdf it talks about how errors are controlled. Basically if an ECM (any device transmitting on CAN bus) detects that it is causing errors, it will remove itself from the bus. Perhaps this is the cause? Just a guess though, haven’t done any testing.

          I have a Mazda that I’m planning on hooking up to a Beagleboard w/barker CAN interface and displayed on 7″ Xenarc. Short term project goals are to display information currently displayed on the in-dash LCD, ie: MPG, range etc… long term project goals would be to have iPhone tethered for internet on the move as well as streaming music to the radio with track data displayed on the Xenarc. Other long term goals (doubt these will ever happen) would include having active sensors for obstacle detection. Warnings would occur if say you had your turn signal on and were changing lanes into another car, for example, but other possible instances could be if your closure rate to a stopped car was too great.

          -Tim

  14. Madox,

    good info here. i have an 08 Mazda3 that i want to pull the codes from the EHPAS power steering controller that is on the CAN network. Were you able to pull codes from other controller in the car?Thanks

    1. Hi, which other controller are you referring to?
      I did get the steering wheel position, one might assume that is from/to the steering controller.

  15. Hello Madox,

    It is the power steering pump controller (EHPAS System). It is physically under the front right heatlight inside the power steering pump. The dealer pulled up 2 codes B1318 – Battery voltage low and C1278 steering wheel angle fault. I am unable to see these code with a regular handheld emission OBD2 scanner. I am trying to get a scanner that can communicate with the controller. See link to someone in your next of the woods that is trying to mimic this controller

    http://www.oz-clubbies.com/forums/index.php?showtopic=5883&st=0&p=54494&#entry54494

    Most commercial software that can read this cost in the next of $260. What sofware are you using?

  16. I’ve got a late model Mazda and I’m wondering if you know if the remote key unlock data is available via the CAN bus.

    Ideally, I’d like to be able to put my own RFID unlock hardware into the car somehow for remote unlock, and would like to know if the idea is viable before buying my own CAN bus hardware.

  17. Hi. My ELM327 based OBD2 / CAN debugger works just great on the HS CAN, apart from its buffer filling because the data rate is too high. However, when I try to move its pins over from 6 & 14 to pins 3 & 11 to get to the MS CAN, I get nothing. Did your CAN debugger just work on the MS CAN, or was there something else which needed to be done as well?

    Thanks.

    1. See my answer further down but you can bump up the speed of the ELM327, I got mine reading everything from the RX-8 (data rate is roughly 1Mb/min)

  18. Hi Madox,
    Thanks for your insightful information.

    I tried acquiring HS-CAN data from my RX-8 (2007 5MT Japan Model), but somehow the CAN format is different from yours.
    I’ve posted my analysis on my blog (perhaps it might be useful for other mazda cars).

    Then I overlaid CAN information on a on-vehicle movie.
    http://www.youtube.com/watch?v=1P50xbqpcZQ

  19. Hi Madox,
    Thanks for your insightful information.

    I tried acquiring HS-CAN data from my RX-8 (2007 5MT Japan Model), but somehow the CAN format is different from yours.
    I’ve posted my analysis on my blog (perhaps it might be useful for other mazda cars).
    http://blog.hiroaki.jp/2010/04/000469.html
    Then I overlaid CAN information on a on-vehicle movie.

  20. Does the 323F BG (1993) have a can bus? Can i recive/send data? What controller do i need? Sorry 4 my bad english!

  21. Anyone! First, I know nothing, but need to be able to feed the dash cluster foriegn signal(s), IE GM, and have it fully functional. Is this possible. The car in question is an 06′ miata getting a V8 swap.

    thanks

    1. Assuming the instruments are CAN then yes it’s possible, I have a set of RX-8 clocks being driven from an arduino with a CAN interface. See http://imgur.com/EPIiV

      You’ll have to find some way to get the signals from the new ECU though, if it’s also CAN you may be able to just connect it to the bus and have an arduino listening for the ID’s and translating for the instruments. Otherwise you’ll need some way to get RPM etc into the arduino.

  22. Thanks for the great info, I’ve just got an ELM327 based device working on my 2006 Mazda 3 on the HS CAN bus. I’m using the Bluetooth OBD-II transceiver from DealExtreme.
    http://www.dealextreme.com/details.dx/sku.16921

    I’m having trouble with the buffer filling up while in “Monitor All” mode, but I guess that’s expected for such a cheap device.

    1. Not sure about bluetooth although ISTR it had a decent speed well above what the ELM327 would handle, I know the version with a USB interface will to up to 3Mbps, the ELM327 itself will do up to 500k (although then you are into module hacking as you have to set some custom serial speeds)

      The speed on the ELM327 can be changed by entering the following commands from a terminal (eg hyperterminal on Windows, cutecom under Linux).

      First set the speed, this is a divisor of 4000 and in hex, so for example here we have 38.4,57.6, 115.2, 230.4kbps.

      AT PP 0C SV 68
      AT PP 0C SV 45
      AT PP 0C SV 23
      AT PP 0C SV 11

      Pick your setting and apply it, then turn it on

      AT PP 0C ON

      Finally reset the device (or unplug and reconnect it).

      AT Z

      Iโ€™ve (personally) tried up to 230.4kbps without a problem which works fine without the engine running but still can’t cope at tickover (strangely it can when being revved), this may be due to having full headers on though, turning off spaces (AT S0), ie removing 1/3 of the data should be enough.

      Note that you won’t be able to use it with the normal tools until you reset it to 38.4k again, should it all go really pete tong you can reset the ELM327 by shorting a pin (see the ELM327 datasheet for details).

      1. Just as an update, I turned off the spaces and it worked perfectly, I have a ~15min drive of *all* data to go through!

  23. Hi, I am working on an interface to the CAN bus – basically I want to code an Arduino processor to emulate the “Rain Sensor” for those who replace their windshields with the non-OEM $1000 one. Do you know what I need to put on the CAN bus to tell the windshield wipers to wipe? This way Mazda owners could at least have a cheap solution for intermittent wipers.

    1. Are you sure the rain sensor is on the CAN bus?

      There are quite a few accessories that is not on the CAN bus, it doesn’t make sense for me for it to be on. All it needs to do is to control the wipers. A lot of the accessories such as the passenger seat belt lights etc are controlled directly from the PJB (Passenger Junction Box) circuitry. I originally wanted to control those lovely seat belt figures ๐Ÿ˜‰

  24. I want to discover some of the Extended PID’s on my Mazda3, namely knock retard.

    i was going to use a CAN sniffer, and spoof the knock sensor using an arduino. I figure I would be able to see information change, and based on the data I discover I may be able to determine the equation. I was going to use the MSD dashhawk to confirm my results.

    Do you think this is possible?

    1. I don’t see why not. I actually bought an OBD-II Reader which I planned to use with a CAN Sniffer at the same time to help me decode more of the messages.

      The plan was to target a specific message (using OBD PIDs) and find the corresponding message on the CAN Sniffer, this approach should work for you if you know the PID of the Knock Sensor.

      1. This is awesome news! I have a friend with a MSD Dash hawk, which is able to see all these extended PIDs.

        The reason why I ask is because I bought an OBD-II bluetooth module and the program Torque for my android phone. It would be SWEET if i can see some of the nifty E-PID data using torque, I just need to know the PID ID and equation, and I can have a gauge displayed on my phone. this would be so useful for doing road tuning on my mazdaspeed3 (and probably all late model mazdas).

        i am a mechanical engineer, not an electrical. however i am pretty savvy and interested in learning more. I would be extremely grateful for any help you can provide…

        Lets see if this makes sense:
        1) set up msd dashhawk to look at and display ONLY the knock retard PID (or whatever other pid i want)
        2) put the sniffer inbetween the dashhawk and the car
        3) find the message the dashhawk is requesting, thereby discovering the PID
        4) spoof the knock sensor with arduino to make the car freak out and spit out a bunch of different readings
        5) somehow using this data, i should be able to determine the equation of the PID.

        I am probably wrong in my approach, but half the fun is figuring it out! Any insight you can give would be awesome. Being that this is an extended PID, I have no information on the actual address of the PID.

        Thank You Tons in advance!

        1. Actually it is different to what I would have done and I’m not sure it’ll work. The ODB-II is an ‘intrusive’ query protocol, the ODB-II tool requests information by query requests using defined PID codes.

          Somehow I think you’re using PID in the control context :> Though that doesn’t make much sense either… What are you trying to do again?

          Spoofing the sensor is going to be tricky…

  25. please delete my reply that has my name and email in it lol… I thought that the reply would require moderation before getting posted automatically…

    email me, and I will email you information on my setup. Thank You!

  26. Have you find anything about window controllers and CAN messages to pull the windows down? what about honking the horn?

    Thanks,
    Reza

  27. Hi,

    We are electrical engineering students and are trying to build a system that would open the windows of a Mazda 3. We have an OBD II to CAN interface and a CAN to USB cable which came with drivers and PCAN-View software. That software allows us to view the messages being transmitted on the network, but we are unsure whether the messages are from the MS or the HS CAN. Also, due to the large volume of messages and the fact that a lot of the messages keep changing despite us not doing anything to the car, we are unable to figure out which messages correspond to the windows and if the windows are connected to the CAN bus at all. Any suggestions as to how to go about this reverse engineering?

    Dharini

    1. Hi,

      Last time I looked, the windows were directly controlled via wiring to the Passenger Junction Box (PJB) and then onto the motors. You can confirm this from the workshop manuals.

      To help isolate signals, I wrote a quick script that highlights if any byte in a message changes and be able to reset that. Worked a treat, had to ignore those constantly changing messages as you point out.

  28. I’ve been having a play with the CAN BUS on the RX-8 and a lot seems to match.

    Anyway as you’ve been a great help I thought I’d give some back:

    0x212 is abs, dsc off, traction control warning and brake warning
    0x300 is steering warning light
    0x420 is for temp and MIL/Oil warning/Coolant warning/Alternator warning (also oil pressure but while a ‘gauge’ it seems either on or off).

    0x430 is coming *from* the instruments, don’t know what it is.

    I’ll give some more details when I have it nicely arranged but you might still be able to get something more from that.

    1. On my 2006FL Mazda 3 at least, I get no change in CAN messages from pressing the wheel buttons [with the exception of the HU message change messages]

      1. On my Mazda 3 I get 0x028F one bit changing on buttons press, volume wheel(same code for all buttns), info, clock, aux, cd, etc… but there is no chanses to get difference between volume up and down and no events on track up/down when media(aux) mode enabled, its just code of the event i guess…
        can’t believe, but there are codes of event without buttons codes )

        1. On my 2005 Mazda3 with the Bose Sound i got the following mappings:

          none of the climate unit nor radio unit has special mapping except for two buttons

          28F -> Byte 4 -> Mask &0x10 -> Clock Button
          28F -> Byte 4 -> Mask &0x08 -> Info Button
          28F -> Byte 4 -> Mask &0x80 -> The rest of the mapped functions

          If you want to know which function is active:

          28F -> Byte 3 -> 0x00 FM1
          28F -> Byte 3 -> 0x22 FM2
          28F -> Byte 3 -> 0x18 EX/CD

          The only hope on this task is to sniff the HU unit protocol which is explained somewhere on the internets, I read some time ago a wiki about CD changer protocol and wheel buttons are mapped.

          1. Hello all,
            if the CD Changer protocol for Mazda still a thema here, so here is a small description of it: http://www.fun-electronic.net/wp-content/uploads/2009/02/mazda-3-radio-system-bus.mht
            And here is some articles about it:
            – with the protocol:
            http://www.fun-electronic.net/lang/de/2009/02/28/mazda-mp3-player-continue-2/
            – the whole thema:
            http://www.fun-electronic.net/tag/m-bus/

            The articles are available on russian and german, so you need to translate it (with google, for example), if you don’t speak/read this languages.

            Hope, it helps,

            Regards,
            MasterAlexei

    1. I found on my car (US 2008.5 Mazdaspeed 3) the following message related to cruise:

      0x4EA byte 0 is 0 when cruise off, 0x80 when on.

      1. Thanks for the reply. I will have to check what is on 0x4Ea on the RX8 but as far as the cruise mode goes I found mine to be on 0x650. But then again, thats just to see if cruse is off or on. Any luck finding if there is a corresponding PID to see if ACCEL or DECEL are being pressed on the cruise control?

        1. I should mention that this was on the HS-CAN. I don’t know about ACCEL or DECEL.

          I’ve been more focused on trying to find any MAF, MAP, or bost pressure data. Turns out it’s pretty tough to reverse engineer some of the scaling factors and units for the messages, let alone what they are in the first place.

    1. Great work!, I need to do some work on the HS CAN later but I can confirm some of the PIDs with my 2005 Mazda3 2.0L.

      0x20F -> Byte 0,1 -> Brake Pressure (I think it’s MPRETDR PID as stated in service manual)
      0x205 -> Byte 2 -> Mask &0x40 -> Brake Pedal Switch (BOO_ABS PID in the manual)
      0x228 -> Same here clutch and neutral
      0x80 -> Same i think
      0x212 -> confirmed

  29. Just started to played a bit with my 2011 Mazda6 Euro and found one interesting:

    CAN ID Byte Bit Info Formula
    0x39e 0 0 Left front door 1 – open 0 – closed
    0x39e 0 1 Right front door
    0x39e 0 2 Left rear door
    0x39e 0 3 Right rear door
    0x39e 1 3 Boot 1 – open 0 – closed
    0x39e 2 0 Headlights 0 – off 1 – on

    Problem with my reversal engineering is cheap Chinese ELM327 v1.4 b clone. Looks like bluetooth module in it cannot programatically change the speed so I’m stuck with 36.4k baud transmission to PC and need to filter out a lot so it goes slowly. Anyone knows if I can somehow hack this thing so BT transmits faster than 36.4k to avoid BUFFER FULL even when sniffing all the can bus data?

    1. If you can check on which chip BT module built, then it will be easy to check with datasheet supported speeds and how to enable them. Without this – it’s very hard to define. As another way, you can order another Chinese Elm327 clone – but USB version instead of BT ๐Ÿ™‚ I own the same (USB), but want to make it both – USB and BT, as ELM itself needs only Rx/Tx, it’s easy to solve using needed mobule, either BT, or FTDI based USB.

      1. Even USB versions of cheap chinese clones say its 38400 baud max…. ๐Ÿ™
        If you can email me with link to “good” device which will allow better speeds it would be much appreciated.
        Address is marlasr(at)yahoo.com. Many thanks in advance.

        Anyway found another one interesting: 0x80 in bytes 0 and 1 has steering wheel position/angle.
        One interesting idea is to use this piece of information together with vehicle speed and calculate driven path, then compare it to the real path obtained via GPS. Already did cross-comparision with speed and values match surprisingly well. No usual “-5km/h” offset like on board gauge.

        At this point I stopped to play with TeraTerm and started writing some C# code to talk to the ELM.
        So far, I managed to connect to ELM, reset it, set speed (AT BRD) to 9600 and 38400 bauds as any other speed does not work correctly, calculate mask and filter for given bunch of ArbIDs… next is implementing filtered ATMA. I need two separate threads – producer that will populate the buffer with data read from ELM and consumer that will update the GUI using info provided and/or log to a file or whatever…

  30. I’m looking to get the odometer off a Mazda 6 2011 to display on my iPhone. Has anyone been able to do this? Do you know where to find it? The odometer for my 2007 Mazda 3 is in broadcast data but the 2011 Mazda 6 isn’t and I haven’t been able to find it.

  31. Hi,

    I just bought new Mazda 6 2.2 129 PS.
    Is there any way to reprogram and make automatic lights to work as a day lights. In Croatia day lights are mandatory, so instead having automatic lights when dark comes, I would like to have lights on every time I start the engine.

    As well I would like to have automatic door lock to lock the doors once I start driving as it is on some another cars available.

    Thanks,
    Alex

  32. I’d imagine the DRL (Daytime Running Lights) aren’t controlled by the computer, it just doesn’t make sense to do so. Same with the door locks, they’d be handled by the body computer and it probably only takes a direct digital input, not a command over the CAN bus. Either way, both can be solved easily with a micro, some code and a little interface work and never have to touch the ECU.

  33. Hello,

    I am working on a project that requires measuring individual wheel speeds. The problem is I have a 2011 Subaru WRX, and I was wondering how would I go about can bus sniffing to obtain those pids.

  34. Hello,
    I’ve got a Mazda5 2008 facelift.
    I took out my HU, so I’ve got empty connection to use with HS Can.
    My question is:
    What do I need to connect to Can system to send messages (speed and fuel level) into my car display?

    Looks like some conversion… to snif on Can and when speed message comes… convert address for a car display…
    and resend it to display part one.
    Similar sytuation is with a fuel level but it needs to be send to display part two…

    any ideas?

    btw. I chacked project on RX-8 but I don’t need that… to many things on it…

  35. Hey guys thanks for all the tips here, they have been most helpful. I do have a question though, I am trying to post a message to my lcd screen, but the messages “fight” with the radio. I try to send them as fast as possible with not much success. Here is a video of what I see. Any one else run into this?

    http://youtu.be/nSd5uOshcK4

    1. ok looks like I fixed the fighting issue …. unfortunately now I am realizing that after sending a few messages to the screen the bluetooth and sat buttons stop responding.

  36. Hi I have a project that I need help with and I have not been able to find any one who can help but it seems you might already have the info I need please email me runnin13s at yahoo.

    I have a 2004 Mazda rx8 with a camaro ls1 motor . I need the rx8 can bus instrument cluster to read/display the ls1 motors analog signals like rpm, coolant temp, oil
    I have purchased an ardruino UNO r3 micro controller and an elm327 from my research I have found I will need these items . But I am not computer savvy and have no idea how to program the ardruino to function properly and I know that te Mazda can bus codes is one of the biggest things I’ll need , can you maybe help?

Leave a Reply

Your email address will not be published. Required fields are marked *