Mazda CAN Bus

Introduction

Read the multi-part blog posts :-

  1. Reverse Engineering the Mazda CAN Bus – Part 1
  2. Reverse Engineering the Mazda CAN Bus – Part 2

Notes :-

  1. I’ve still got some data from another person on a similar quest to combine into this data… if you have any info/data as well.  Let me know and I’ll add it too.
  2. Ignore my silly colour schemes 🙂  I think blue is confirmed, and all others…mean something.  I’ll clean it up later.

HS-CAN Data

This is the HS CAN data.  500 kbps / 500kHz.

Can Message Identifier Byte(s) Bit Bitmask Description Comment
00000040 Only lasts when key is first on
00000046 Only lasts when key is first on
00000190 2 6 0x40 Brake Active
00000200 0,1 Unknown Correlates with with 00000200(4,5) & Acceleration
00000200 2,3 Unknown
00000200 4,5 Unknown Correlates with with 00000200(0,1) & Acceleration
00000200 6 7 0x80 Unknown
00000201 0,1 RPM Scale = X rpm.
00000201 2,3 Unknown Offset by 0x4000. Appears to be the ‘delta’ in engine torque? Derivative of rpm? Cumulative returns to zero.
00000201 4,5 Vehicle Speed Scale = X/100 km/h. Unsigned.
00000201 6 Accelerator Pedal Accelerator Position. 200 is fully depressed.
00000205 2 6 0x40 Brake Active
0000020F 2,3 Vehicle Speed Scale = (X-10000)/100 km/h, unsigned (Refer to handle position). Correlates with 0000004B0 wheel speeds.
0000020F 4 6 0x40 Unknown Appears always on
00000211 2 7 0x80 Unknown Appears always on
00000211 4 6 0x40 Unknown Appears always on
00000212 0 7 0x80 Unknown Appears always on
00000212 2 5 0x20 Unknown Appears always on
00000212 3 7 0x80 Unknown Appears always on
00000212 4 4 0x10 Some Dash Warning Light… Off when ignition is off
00000212 4 6 0x40 Some Dash Warning Light… Off when ignition is off
00000228 0 0 0x1 Off (Park) 0x03 appears to be ‘neutral’
00000228 0 1 0x2 Reverse 0x03 appears to be ‘neutral’
00000228 0 2 0x4 Forward (Drive)
00000228 0 3
00000228 0 4 0x10 1st Gear
00000228 0 5 0x20 2nd Gear
00000228 0 6 0x40 3rd Gear
00000228 0 7 0x80 4th Gear
00000228 1 3 0x8 Gear Shift Active for several messages on each gear change.
00000228 1 4 0x10 Unknown Occurred once on a gear change
00000228 1 6 0x40 Something to do with brake pedal
00000228 1 7 0x80 Manual/Triptronic
00000231 0 0 0x1 Unknown Not Brake, but very close…changes not far from brake
00000231 0 1 0x2 Unknown Always appears off
00000231 0 2 0x4 Unknown Always appears off
00000231 0 3 0x8 Unknown Always appears off
00000231 0 4 0x10 1st Gear Reverse = 0xE?
00000231 0 5 0x20 2nd Gear Reverse = 0xE?
00000231 0 6 0x40 3rd Gear Reverse = 0xE?
00000231 0 7 0x80 4th Gear Reverse = 0xE?
00000231 1,2 Unknown Torque? RPM demand x 10?
00000240 0 Unknown Varies, not correlated with speed/accel. Around 10/11/12 when stationary.
00000250 0 Unknown
00000250 1 Unknown
00000250 2 Unknown
00000250 3 Unknown Accelerator Position. 225 seems fully depressed, but bias of 32… See other accel pos. This might be the raw value, some noise.
00000250 4 0 0x1
00000250 5 1 0x2
00000250 5 2 0x4
00000250 5 3 0x8
00000250 5 4 0x10
00000250 5 5 0x20
00000250 5 6 0x40
000002A0 Unknown Appears to be all zeroes (4 byte frame)
00000420 0,1 Unknown
00000420 1
00000420 2 Unknown Counter (Always Increments)
00000430 Unknown Not sure if 2 bytes or byte pair.
00000433 1 0 0x1
00000433 2 0 0x1 Unknown Not seen to change (0)
00000433 2 1 0x2 Unknown Changes
00000433 2 2 0x4 Unknown Changes
00000433 2 3 0x8 Unknown Not seen to change (1)
00000433 2 6 0x40 Unknown Not seen to change (1)
00000433 3 0 0x1 Unknown
00000433 3 1 0x2 Unknown
00000433 3 2 0x4 Unknown
00000433 3 3 0x8 Unknown
00000433 5 0 0x1 Unknown Not seen to change (1)
00000433 6 0 0x1 Unknown
00000433 6 1 0x2 Unknown
00000433 6 2 0x4 Unknown
00000433 6 3 0x8 Unknown
00000433 6 6 0x40 Unknown
000004B0 0,1 Left Front Wheel Speed Check Order. Scale = (X-10000)/100 km/h, unsigned (Refer to handle position). Correlates with 00000020F vehicle speeds.
000004B0 2,3 Right Front Wheel Speed Check Order. Scale = (X-10000)/100 km/h, unsigned (Refer to handle position). Correlates with 00000020F vehicle speeds.
000004B0 4,5 Left Rear Wheel Speed Check Order. Scale = (X-10000)/100 km/h, unsigned (Refer to handle position). Correlates with 00000020F vehicle speeds.
000004B0 6,7 Right Rear Wheel Speed Check Order. Scale = (X-10000)/100 km/h, unsigned (Refer to handle position). Correlates with 00000020F vehicle speeds.
000004DA 0,1 Steering Column Angle (X-32768)/10 Degrees, Clockwise +ve.
000004DA 2 6 0x40 Unknown Not seen to change (1)
000004DA 2 7 0x80 Unknown Not seen to change (1)
000004EA Unknown 1 Byte Frame always 00
000004EC Unknown 8 Byte Frame always 00
000004F0 Unchanging Unknown Every 5s 14 24 12 FF FF 7F
000004F1 Unchanging Unknown Every 5s 4A 01 9F FF FF 64 5E 5E
000004F2 1,2 Odometer (Total) Might be first byte too to get the range
000004F3 Unchanging Unknown Every 5s 32 30 33 30 30 38 31 31
000004F4 Unchanging Unknown Every 5s 42 4B 31 30 46 32 30 30

MS CAN Data

This is the MS CAN data. 125 kbps / 125 kHz.

Can Message Identifier Byte(s) Bit Bitmask Description Comment
00000023 1 7 0x80 Unknown Not seen to change (1)
00000201 0,1 RPM
00000201 2,3 Unknown Offset by 0x8000. Appears to be the ‘delta’ in engine torque? Cumulative returns to zero.
00000201 4,5 Vehicle Speed Scale = X/100 km/h. Unsigned.
00000201 6 Unknown Accelerator Position? Very closely linked with accelerations (not decel).
00000265 0 5 0x20 Unknown Left Blinker – Indicates light on. (It pulses too!) Check hazard
00000265 0 6 0x40 Unknown Right Blinker – Indicates light on. (It pulses too!) Check hazard
00000285 0 5 0x20 Unknown key pos?
00000285 0 6 0x40 Unknown key pos?
0000028F 0 4 0x10 Unknown volume?
0000028F 0 6 0x40 Unknown volume?
0000028F 0 7 0x80 Unknown volume?
00000290 1,2,3,4,5,6,7 HU LCD Alphanumeric Display 1/2 ASCII Byte Codes
00000291 1,2,3,4,5,6,7 HU LCD Alphanumeric Display 2/2 ASCII Byte Codes
00000400 0,1 Average Speed Average Speed in Km/h. Might be single byte only
00000400 2,3 Fuel Consumption Instantaneous Fuel Consumption L/100km. Scale X/10.
00000400 3,4 Average Fuel Consumption Fuel Consumption (L) per 100km. Scale X/10. Might be single byte only.
00000400 5,6 Distance Remaining Distance in KM remaining
00000401 0 Unknown Not seen to change (0)
00000420 0 Unknown Rises then levels off…Temperature?
00000420 1,2 Unknown Increasing counter?
00000420 4 1 0x2 Unknown
00000420 4 6 0x40 Unknown
00000433 2 Guess only, temperature in C X/4 (0.25deg C incs)
00000433 3 0 0x1 Key On?
00000433 3 3 0x8 Air Con running?
00000433 3 6 0x40 Highbeam (Indicator Light)
00000433 4 Headlight & Wiper
00000460 Key position?
00000501 Key?
00000511 Key?
http://www.madox.net/blog/2009/10/24/reverse-engineering-the-mazda-can-bus-%e2%80%93-part-2/

136 thoughts on “Mazda CAN Bus”

  1. Re: Rx-8 instrument Cluster
    anyone know how to fool the cluster into thinking the parking light / head light’s are on?
    got it working on my desktop simulator but i want the clusters red lights to turn when i turn the lights on.
    it’s a CAN signal but dunno which id.

    Reply
  2. Pingback: Reverse engineering the RX-8′s instrument cluster, part one - Cantanko

      1. Did you by chance get any cmd that get sent to Power Steering pump
        Trying to work out how to control it

        Reply

  6. I own a mazda cx-5. Wipers/rain sensitivity and lights/doors can be set up from headunit. Could be they adjusted via can bus commands? I am going to replace HU by an aftermarket one and inject bus commands from android kernel to canbus (via USB)
    Could this be done? Can I use the stock head unit to identify can bus pid that HU sends when setting options? Any tip for achieving this?
    Many thanks in advance

    Reply
  7. Pingback: Introducing the CANBus Triple! - Page 8 - Mazdaspeed Forums
  8. Pingback: Indie Game Developer！ | WTF! It Should Not Be Illegal to Hack Your Own Car’s Computer
  9. Pingback: WTF! It Should Not Be Illegal to Hack Your Own Car’s Computer | Nagg
  10. Pingback: It Should Not Be Illegal to Hack Your Own Car’s Computer | iFixit

  11. Did you try sending something over CAN? I would be interested in sending text to LCD? I wonder if I send message same as that coming from radio will it get replaced?

    Reply

  12. On my Mazda 3 2010, I am wanting to change the language from Japanese to English on the multi information screen. Now I dont have the original radio deck in the car, and can only assume that certain settings are unavailable with the original deck removed. Do you not think that maybe identifier 401 may have something to do with the displayed language, and if so, how do I go about changing it?

    Reply

  14. My 2004 Mazda Rx 8, 6 speed manual is giving me steering angle sensor problems and my steering is rock solid and no idea on what to do considering it doesn’t use power steering but only electrical

    Reply

  15. Is it possible to create an analogue to CanBus communication for the Power Steering pump? For example for years many many different communities, sports cars, rotary, electric vehicles, etc have use the Toyota MR2 power steering pump due to the fact that a VSS signal dirrectly from the sensor could be input and the pump worked perfectly regardless of vehicle.

    Now if we were able to determine the engine speed output, and Vehicle speed outputs and then feed them via appropriate CanBus protocol to the Mazda3 Power Steering Pump, then it would be beneficial to many communities, as these pumps are readily available. This could even be a product for sale?

    Any thoughts on how to accomplish this?

    Thanks

    Can Bus Illiterate

    Reply

      1. Any progress with sending CAN signals to a mazda power steering pump to make it run?? without computers, modules, sensors…….

        Reply

        1. Did you get a solution to this
          Im about to try it now and if can find can messages I can make module for it

          Reply

    2. I too have a Mazda 3 EPS and wish to use it on a 1999 Miata with an LS1 swap. Do you know what CAN Bus command(s) I need to send to it to turn it on? I plan on using an Arduino or Raspberry Pi with a CAN interface. Can I get by without the steering wheel position sensor? I don’t have one.

      Larry

      Reply

  16. Hi

    Somebody have mapped CAN BUS on RX8 ? I’ve RX8 cluster and I want to use this cluster on other vehicle, but cluster don’t count (increase) trip. What ID and data must be send, that cluster count trip. I sent 201 , 420, 300 and 212, all function work ok, but trip counter not.

    pls help

    Reply

  17. I just want to notice that some CAN-Compatible devices do map single inputs on single bytes on their messages, so the stream of data might seem kind of random.
    A second thing you should know is, that some Controllers may send an “Heard Beat” to say that they are on and working as they should (it’s mostly an “increasing Counter”)

    Reply

  18. Hallo,
    RVM need to activate the car Mazda6 GH. The system is not installed in the factory. I now have radar connected, but there is not communication between the CAN bus and radar.
    7C4-01-01 address not available. What do I need to activate?
    Please help

    Reply

  19. Hi,

    I try to log can bus on my Mazda2 also. the thing I interest is Vehicle speed, steering wheel, brake and acc. pedal. but it seem like the value is not match with the table at all (Mazda2 and 3 is pretty similar so I thought CAN Id of both model should be similar)
    In my log there is no CAN ID 201 and 20F.
    Has anyone it here try to log CAN BUS on Mazda2?

    Reply

  20. Hi Madox!
    Im writing from finland for a little problem. I just bought Mazda CX-7 2008. There is 6 disc cd player. There is all so media button on the player to chance the media source, yes… but no, this media button doesn’t work. I had connected bluetooth/AUX box behind this cd player but it won’t find it? Nothing happens if i push it…all what happend when i start the car is bluetooth box light’s up. Is there some kind of yes/no selection in CAN-BUS about this media button to activate?

    Reply

    1. Huomenta, that button is part of the head unit itself if it is similar to my Mazda and doesn’t appear to use the CAN. Same for the buttons on the steering wheel.

      Reply

  21. Hi.

    I have an Australian Mazda 3 MPS (2006) Gen 1.
    Fuel guage is doing strange stuff, goes to 200% full usually on hot days!
    Was wondering what you thought of me trying to fit a RX-8 cluster in place of my Mazda 3 cluster.
    It will physically fit, just the connectors are different.

    Kind regards, Greg Meredith 0438323626

    Reply
  22. Pingback: It Should Not Be Illegal to Hack Your Car’s Computer | iFixit

  23. Hi all, and a big thanks for your work!
    I just want to ask if somebody has some information about disabling the tire pressure warning light in the instrument cluster of an RX8.
    Im working with the cluster on my desk and I managed to get every warning light dark, but this one keeps flashing and I have no clue, if it is controlled by a can message or not.

    Reply

  24. Your experiments are a great motivation, thanks a lot! I have a European Mazda 6 GJ SkyActive D (2015) and I will definitely have a look at the busses. In the long run, it would be great to create some hacks, like detecting long presses on the remote control and opening/closing the windows with it. But before that, I’ll better get used to everything – I don’t want to brick a 17k€ toy that I need to get to work 😉 Cheers from Krefeld!

    Reply

    1. Hi Rob
      I’am also working on a German Mazda 6 GG/GY (2003) to decode the CAN Bus. Have you been successful with yours?

      Reply

  25. I recently installed Pioneer NEX stereo in my 2015 Mazda MX-5. Utilizing a Maestro SW for steering wheel controls initially everything appeared to work great. I recently went to use the the Manual mode (shiftable automatic MX-5) and it would not shift over. It just stayed in automatic. Do you guys have any suggestions?

    Thanks

    Reply

  26. This stuff is beyond me, but hoping you could help or get me in the right direction. I recently replaced the radio in a shift-able automatic 2015 Mazda MX-5 with a Pioneer AVH-2550Nex. I used the iDatalink Maestro -SW to retain steering wheel controls for the media, but appear to have lost my Manual mode shifting. Then I went back over everything and the only thing that I could see that isn’t connected appears to be the connection to the OEM radio for the 3.5mm auxiliary in the car. Is there some sort of issue with the Maestro?

    What is happening is if I try to move the shifter into Manual, it just pretends like I didn’t. If I try to use the paddle shifters, it shows what gear that it is in and shows that I am in Manual, but then it will go back to Automatic mode after a second or two.

    Thanks in advance.

    Reply

  27. Hi I have some new codes, this is from a 2005 MX-5 (NC1).

    Manual Transmission 6-speed
    0x231
    FF 4 FF FF in neutral, clutch out
    FF 6 FF FF in neutral, clutch in
    FF 2 FF FF in gear, clutch in (any gear, including reverse)
    FF 0 FF FF in gear, clutch out (any gear, including reverse)

    0x430 fuel level
    first byte in hex convert to decimal then / 2.55 is I think fuel level
    think it comes from the instrument cluster
    eg 0x63 = 99 decimal / 2.55 = 38.8 (%)? looks about right by gauge, need to test with full tank etc.
    Have not tested this 0x430 code yet.

    Reply

  28. Been fooling with the EHPS pump from this vintage Mazda 3. The 0x240 message originates from the pump, and byte 0 is related to the pump RPM. Possibly RPM / 10 or something? At pump “idle” it runs 03x-04x, the highest I have seen it run is 0x25 or so.

    Reply

  29. Hi,
    Would you know the CAN message that go to the power steering pump to control its speed

    Trying to put one in to a Landrover

    Reply

  30. Hi,

    Your insight into the working of the Mazda 3 canbus has spurred my arduino project onwards.

    I am doing a project using a CX-5 Electric car seat for my sim pit. I have been advised to use a CAN-BUS shield to an Arduino and use it to sniff out the commands used by the seat controller.

    Have you used a canbus shield to snif out the codes used on your project?

    also

    Do you have any knowledge on hacking the Mazda electric car seats, and if so would you contact me on my detailed email please so I can discuss further.

    Reply

  31. Hello Does anyone know where on a mazda 3 2008 can you find all the termination resistor. I have found one in the PCM 120 ohms and one in the body control module (gem module) 120 ohms. I believe that there are 2 others does anyone know where they are?

    Reply

  32. Hello

    Do you know the address of right button for change miles to km on rx8 cluster, please ?
    And somes informations

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.