{"id":22,"date":"2008-11-17T22:37:38","date_gmt":"2008-11-17T11:37:38","guid":{"rendered":"http:\/\/www.madox.net\/blog\/?p=22"},"modified":"2008-11-18T00:42:40","modified_gmt":"2008-11-17T13:42:40","slug":"reverse-engineering-the-mazda-can-bus-part-1","status":"publish","type":"post","link":"http:\/\/www.madox.net\/blog\/2008\/11\/17\/reverse-engineering-the-mazda-can-bus-part-1\/","title":{"rendered":"Reverse Engineering the Mazda CAN Bus – Part 1"},"content":{"rendered":"

Controller-Area Network<\/a> or CAN Bus is one of many automotive communication buses for communications between various ‘car computers’.\u00a0 Information such as speed, fuel consumption, accelerator pedal position is all transmitted between the various controllers of a car akin to ‘fly-by-wire’ control systems of aircraft but I guess ‘drive-by-wire’ is more appropriate in this case.<\/p>\n

There are other rival bus technologies include LIN (Local Interconnect Network) which is supposed to be a lower cost alternative to CAN, but I’m not interested in that.\u00a0 Why?\u00a0 My car uses the CAN bus, not LIN, not Ethernet.\u00a0 So lets go about figuring what can be gleened from the communications whizzing around my car!<\/p>\n

\"Aside<\/a>
Aside from CAN bus, my car has a pig too (Long story). This photo is from 2 years ago and the pig no longer has the weird thing hanging from its belly or the tag on its ass...<\/figcaption><\/figure>\n

<\/p>\n

Background \/ Reason Why<\/h2>\n

In June 2006 I bought a ‘new’ car, an Australian Mazda 3 Facelift Model.\u00a0 The car was a great drive, Mazda excelled in the build and features but one thing nagged at me – the speedometer.\u00a0 It was stylish I had to admit but the scaling was ‘off’ to me.\u00a0 0 speed was vertically down and the scaling was… better not rant on but the thought was ‘maybe I can get another speedometer on’.\u00a0 A history of my ‘better speedometer’ fantasies follow \ud83d\ude09<\/p>\n

\"My<\/a>
My old (and free!) Sony Ericson showing my speed on a MagLev<\/figcaption><\/figure>\n
\"Testing<\/a>
Testing the feasibility of using the same crappy phone as a HUD on another car of mine on a rainy night...yup that's the image on my windscreen!<\/figcaption><\/figure>\n

A little bit of research later I found out the Mazda had two CAN buses: a ‘HS-CAN’ (High Speed) network on which most of the essential systems (ECU, ABS) were connected, and a slower ‘MS-CAN’ (Medium Speed?) network on which accessories such as the audio system were connected.\u00a0 These two networks are joined together by the instrument panel which also acts as the gateway to allow some messages to pass between the two networks.\u00a0 Both buses are conveniently available via a ‘standard’ J1962 plug just below the steering wheel (Do a search on OBD<\/a>) so I didn’t have to hack anything open.<\/p>\n

[Note : Most of the information below is from back in 2006, I only recently picked this project back up]<\/p>\n

[Note 2 : Please don’t any of what I say below if you’re not familiar with electronics\/cars or if you value your life… I hold no responsibility for anything that happens… I need to learn how to write a better disclaimer]<\/p>\n

So what is on the network exactly?<\/h2>\n

Officially?\u00a0 ‘I dunno’.\u00a0 Mazda naturally doesn’t publish this information nor can it be found on the net easily, I hope Mazda doesn’t take offense at me writing this post actually… I loved the car and I’m doing this because its such a great car \ud83d\ude09 [\/grovel].<\/p>\n

Now if that information isn’t forthcoming from the great ol’ google, I just had to try figure it out for myself!<\/p>\n

How it was done<\/h2>\n

First step – Find the pin-outs of the J1962 connector, since its standard connector albeit with slightly different pin-outs per car type the answer is easily found on google.\u00a0 Go search it up yourself \ud83d\ude42<\/p>\n

Second step – Oscilloscope.\u00a0 A lovely portable fluke connected to the two CAN bus lines told me the baud rates of each of the two buses.\u00a0 500kbps and 125kbps respectively.<\/p>\n

Third step – Start sniffing, or at least buy the stuff to do so.\u00a0 I had wanted to build my own CAN interface board but laziness got the better of me and I bought the cheapest one online I could find from QProtos<\/a>.\u00a0 In hindsight it wasn’t the best choice but it wasn’t that bad either.\u00a0 Coupled with a J1962 cable from OBD2Cables.com<\/a> (only remember them because i’m still receiving email offers hehe) I had everything I need to start.<\/p>\n

Fourth step – Really start sniffing.\u00a0 A precaution I took was to set the CAN-USB adaptor to ‘listen’ mode only, I didn’t want to risk the brakes suddenly not working.<\/p>\n

A bunch of static tests to start things off nice and slow.\u00a0 The methodology was simple, start the CAN bus logging then carry out actions on the car at certain times – turn the blinker, step on the accelerator etc.\u00a0 All was left to be done was to review the logs to see which bits or bytes changed at those matching times.<\/p>\n

Fifth step – The fun bit!\u00a0 Dynamic testing!\u00a0 This time with the same setup as above but with my GPS phone logging simultaneously too.\u00a0 Oh what fun you can achieve here.<\/p>\n

\"Speed<\/a>
Speed from GPS vs Speed from CAN bus<\/figcaption><\/figure>\n

Anyone familiar with the Australian Design Rules and the laws?\u00a0 The displayed vehicle speed must not be reported lower than actual, so what most manufacturers do is artificially bump that number up.\u00a0 Hence you see the almost always consistently higher CAN speed compared to the GPS speed… Hey I haven’t even said how many ‘speed’ signals are transmitted across the CAN bus…the ‘actual’ (unmodified) one is there too.<\/p>\n

The state of affairs<\/h2>\n

As of the end of 2006 (Yes two years ago) I had mapped out … (in no particular order…well actually in order of CAN bus ID’s)<\/p>\n

On the HS-CAN<\/p>\n