136 thoughts on “Mazda CAN Bus”

1. hello! thank’s a lot for this information. i have a question regarding CAN terminology – what is the difference between kHz and kbps? Why kbps is one half of kHz? I read the datasheet for MCP2515 (Microchip CAN controller) – they talk about kHz only…
   Do you know what message id is responsible for controlling left part of the LCD – clock/avg speed/instatnd fuel cons/avg fuel cons/distance remaining?

   Reply

2. I made a boo-boo 🙂 Edit – Boo-boo and a couple of other typos corrected!

   There is no difference in kHz vs kbps, they should be identical as CAN bus uses NRZ encoding.
   kbps would be half of kHz in say Manchester encoding.

   Message 00000400 as per the table above shows the trip computer information such as fuel consumption etc etc!

   Reply

3. Hello, thanks for this info.

   I’m currently trying to find a way to use the H/U Alphanumeric LCD screen on a Mazda 6 for my own purposes … Sending messages on the bus to display something shall be trivial.

   However, I don’t know how I can manage to have the HU stop outputting these messages in order not to mess with mine.

   I can of course cut the H/U of the CAN bus, but I don’t like this idea, cause it might be used for some other things.

   Does anyone have a greater idea ?

   See you 😉

   Reply

4. You can send the 3 frames with the following IDs:
   0x28F: LCD settings and probably some other settings (you just send the same data you receive in a normal 0x28f frame).
   0x290: 0xC0 (first byte) followed by first 5 alfanum signs
   0x291: 0x85 (first byte) followed by the next 7 alfanum signs

   all of them, just after you receive the 0x291 frame id sent by the HU. This will make your text being visible with almost no flicker at all.
   The reason for sending the 0x28F is that it is required for displaying the 0x290 and 0x291 text, otherwise the LCD seems to simply ignore the 0x290 and 0x291.
   Another method would be to set a timer with a 150ms interrupt and send the 3 frames described above.

   You can contact me on my email because I am also working on displaying the fuel consumption for Mazda 3 CE 1.6i 2008 (on the 2008 version you cannot enable the computer like for the 2006 and older models).

   Reply

5. 0x28F frame content that I have used:
   hex: D1 00 00 00 80 00 00 01

   my email: gaby.radulescu@gmail.com

   Reply

   1. I have another problem:
      I am using a PIC18F458 with integrated CAN controller and a MCP2551 CAN tranceiver, 16 MHz oscillator (with High Speed no PLL), 124 Ohm between CAN H & CAN-L, + about 1m of cable.
      On CAN – MS 125Kbps:
      For some reason I cannot receive any frame after about 3-4 seconds, but the transmission works fine (with the application above). Last time when I checked there were a lot of error interrupts for reception.
      The baud configuration is the following:
      BRGCON1.BRP = 7
      BRGCON1.SJW = 0
      BRGCON2.PRSEG = 0
      BRGCON2.SEG1PH = 2
      BRGCON2.SAM = 0 (sampled once)
      BRGCON2.SEG2PHTS = 1 (segment 2 phase freely programable)
      BRGCON3.SEG2PH = 2 (phase of segment 2)
      BRGCON3.WAKFIL = false

      Has anyone good settings for CAN on either speed. There might be some other reason for losing the communication after 3 seconds, some other settings.

      Gaby
      gaby.radulescu at gmail.com

      Reply
6. Pingback: Madox.NET » EasySync USB-CAN Bus Adapter – Works great in Ubuntu after some fiddling

   1. Could you explain this CAN message identifiers? Are they really CAN or it’s KWP2000 оr J1979?

      Reply

      1. Its really CAN as active on the car without any J1979 or other queries etc.

         The CAN adapter was set to ‘listen’ mode to sniff what occurs on the car normally without diagnostic messages flying back and forth.

         Reply

7. Hi,
   Wonder if you can help me, some great info here on your site.
   I’m building a kit car at the moment and looking to use some late Mazda instruments, maybe from an MX5/Miata or a Mazda 3 or 6, however I think these are all CAN bus, how difficult would it be to make them work with standard analogue signals, do you know?

   Thanks

   Reply

   1. Hi Ed,

      I actually doubt they’re CAN Bus, and would presume the actual instruments are analog or digital devices.

      This is my assumption only but I believe the instrument panel on the Mazda’s are driven by a CAN bus controller gateway rather than each instrument having a CAN controller individually. Have you got one you can tinker with?

      Why not just get some other instrument gauges or even a microcontroller with a screen to use as well? I was really tempted by this one 🙂
      http://www.4dsystems.com.au/prod.php?id=33
      http://www.4dsystems.com.au/prod.php?id=34
      (Might be a bit small) A few of these would make an interesting instrument panel I’ll say.

      Reply

   2. Having looked into the RX-8, some of the functions (eg fuel) are non-CAN but speed/rpm and most of the warning lights are CAN.

      You could fairly easily rig up something to translate a ‘classic’ sensor or two into a CAN signal, eg an arduino with the Spark-fun shield or (if you don’t mind some soldering) a cheaper CAN shield from here http://www.fazjaxton.net/products/canshield/

      Reply

      1. See http://imgur.com/EPIiV for proof of using the RX-8 clocks with generated CAN data.

         Reply

8. Ed is right, the instruments (on the 2006+ MX-5 at least) are almost entirely driven from CAN. The car’s ECU takes the analog inputs, and I suspect the needles are driven by stepper motors (not verified yet, since I haven’t had my cluster apart yet).

   BTW, I have an earlier version of the 4D systems display (128×128), driven by a custom Propeller-based board. Nice bright high-contrast display, and should work nicely in the car. I was building a fuel gauge for a race car, but so far I haven’t tried it in the car. I was planning to use the same display to replace the totally-fake “oil pressure” gauge in the MX-5.

   Reply

9. Hi Jim,

   What I meant was even though the instrument cluster itself is CAN bus, there is only one master controller on it. Each of the individual instruments themselves are probably analog or stepper gauges as you mentioned.

   The only thing to watch out on the OLED displays is managing the lifetime of the colours…

   Reply

10. Actually the big problem with the 4D OLEDs is managing power. If you drop power to the external controller and the display at the same time, the display fails in short order. So I had to build a hardware/software power management system to be sure the display is powered down for a little while before the controller powers down. It’s a serious weak spot in at least the early displays like mine; perhaps they’ve designed around it in later models.

    Reply

11. Hi Madox,

    I’ve been trying to understand how ECU programming for Mazda is made and got absolutely confused. Maybe you can explain what it’s all about.

    Here’s my quest:
    Mazda says that J2534 can be used for ECU/ECM/PCM programming:
    http://www.mazdatechinfo.com/home/ecmDetail.asp
    And even gives the list of hardware validated by Mazda. Each of them costs about 2000$. Looks like conspiracy to me 🙂

    First of all I’ve found the information about J2534 passthru devices here:
    http://www.drewtech.com/support/j2534/intro.html
    They say “A J2534 device plugs into a cars’ OBD connector on one side, and a computer on the other side. These devices are not made by car manufacturers, but by any company that sees an opportunity. Under the hood, the device must speak a myriad of different vehicle protocols (ISO9141, J1850VPW/PWM, CAN, etc.) used by the different manufacturers.”
    This SAE J2534 standard is just a set of API, which hardware manufacturers should implement if they want their hardware to be used by car service software, which is based on J2534 API. (Just like NDIS for network cards)
    The example is Tactrix Openport:
    http://www.tactrix.com/product_info.php?cPath=22&products_id=49&osCsid=b635484bda09c8993a1c286b53b3dd72
    it’s a device that is able to communicate ISO9141(Kline/Kwp2000), ISO15765(CAN), J1850.
    Tactrix Openport hardware is connected to PC via FTDI chip, just like many other diagnostic hardware. Plus they have op20pt32.dll which implements J2534 interface. I.e. this dll exports a set of function with names “PassThru*” but actually sends commands to FTDI chip.

    I’ve looked at the logs of flash programming sessions made by EcuFlash:
    http://forums.openecu.org/viewtopic.php?f=15&t=4135&sid=3b05ab66d6840e66ec2cbdf623e58eb9
    Quote:
    [2208] PassThruConnect(DeviceID=1,ProtocolID=3,Flags=00000200,Baudrate=4800,pChannelID=@094F119C)
    ProtocolID=3 means ISO9141

    So it seems like everything you need is to be able to communicate via ISO9141, and you’ll be able to flash the ECU over OBD-II socket.

    Next thing I wondered was the difference betweed the Scan tools and the Flash tools. I have ELM327 scantool. Which is also able to communicate “a myriad of different vehicle protocols (ISO9141, J1850VPW/PWM, CAN, etc.)”. But on some reason there’s no software that uses it for flashing. WHY???

    I’ve tried to ask ELM Electronics about it.

    Me: According to ELM 327 documentation it supports all the ODB-II interfaces.
    So, it should be able to work as SAE J2534 pass-thru device.
    Is there j2534 API DLL for ELM devices?

    Elm: The ELM327 does not support J2534 pass-thru.

    Me: Is it a hardware or software incompatibility?

    Elm: It is a design decision that we do not plan to support J2534, with the hardware and the software.

    What is so magical about J2534 hardware, if it’s actually a set of API which just knows what to send over which of OBD-II protocol? Why can’t scan tools do the flash programming?

    Reply

    1. The answer is found. Scantool is unable to set the programming voltage, that’s why it can’t be used actually. Never the less, J2534 is not a must tool for flashing. Old mazda cars, which used ISO9141, can be programmed via Openport 1.3. The schematics can be found at openecu.org. The new cars are flashed over CAN. But connecting to CAN pins at OBD-II plug is not enough. There’s some magic that should be done about setting the voltage on ECU pins.

       Reply

12. Does this information apply to Mazda2?

    Reply

13. Programming voltage may be needed for some applications, but it doesn’t appear to be universal. The Mazda MX-5 (2006 specifically) doesn’t have provision for voltage to be supplied from the J2534 device — there’s no separate wire to the ECU, and the power pin is hard-wired to the battery. As far as I can tell the programming is done entirely via CAN frames.

    Reply

14. I’ve recently had a Mazda MX5 ECU apart, helping do some reverse engineering of it. First installment of info is on my blog at http://clownspeed.com/?p=116 for anyone interested.

    Reply

15. Hello Madox, I’ve reversed my Mazda6 2003 2.3NA CAN recently, compare to your Mazda3, there’s much less info on the bus cause my car is older. It only has CAN ID 200, 201, 210, 211, 215, 216, 231, 240, 420, 430, 4b0, 4c0, 4c1, 620 and 630. It has no what called “trip computer” info, but I’ve discovered some other useful info, like DSC switch condition, MIL light condition, coolant temperature, calculated engine load, fuel injection amount….But your this list gives me many ideas to dig it deeper! thanks alot!

    Reply

16. Hey guys,

    What software packages do you recommend I use to tap into the CAN Bus? My Vaio runs windows 7 and it would be preferred, but I’m proficient with any UNIX OS and can use that as a last resort. Once I tap into the bus, will crafting a packet with the information detailed above TRIGGER the system, or is the information above simply so I know what I’m looking at when I see the packet come across my terminal? IE: If I wanted to re-create the “INFO” button on my headunit and trigger the fuel computer to show fuel remaining, would I simply create a packet with Message ID 00000400 that’s 5-6 bytes in size? If not, how would I trigger the system? My goal is to reproduce the “INFO” button via computer.

    Reply

    1. The message is constantly being transmitted on the CAN Bus, all you’ll have to do is sniff in and parse the information to be displayed. Even I have a paranoid side and having the device on ‘listen mode’ only makes me feel a bit better that I’m not screwing with the car while I’m driving it. Want to see my stupid rush job php script? 🙂 [Which should work in Windows too…]

       Reply

17. Let’s see it =) Can’t be worse than the hacked main.c I’m tearing apart. (Building a linux cli tool based on CANUSB’s linux driver)

    Reply

    1. Yes it can be 🙂 The EasySync USB-CAN device is a bit too slow to be able to ‘override’ the HU unit display. All I got was flickering between the original and what I want to display…eek… need a microprocecessor to do the headunit override…

       On the plus side, I’m back! 🙂 Haxe/php code on http://mchumby.googlecode.com/

       Reply

       1. From my own testing, the flicker is due to the fact that you are not stopping the radios HU text being displayed, but just setting your own text. The LCD receives both commands (yours and the radios) and thus it will always flicker due to it changing. I was able to send the command fast enough so only my text was displayed and the flicker was next to non, the issue I encountered though was that the Radio stopped sending and more text to the LCD. It seems it detected something else was sending text commands and so it would stop. This then was no good as there was no way to stop sending my text and have the radio text re-displayed. You would need to design a pcb that sits in-between the radio and the lcd and only send radio text commands through if your not setting your own text.

          Reply

          1. Might have something to do with the CAN standard. If you look at this: http://www.keil.com/download/files/can_primer_2009sp.pdf it talks about how errors are controlled. Basically if an ECM (any device transmitting on CAN bus) detects that it is causing errors, it will remove itself from the bus. Perhaps this is the cause? Just a guess though, haven’t done any testing.

             I have a Mazda that I’m planning on hooking up to a Beagleboard w/barker CAN interface and displayed on 7″ Xenarc. Short term project goals are to display information currently displayed on the in-dash LCD, ie: MPG, range etc… long term project goals would be to have iPhone tethered for internet on the move as well as streaming music to the radio with track data displayed on the Xenarc. Other long term goals (doubt these will ever happen) would include having active sensors for obstacle detection. Warnings would occur if say you had your turn signal on and were changing lanes into another car, for example, but other possible instances could be if your closure rate to a stopped car was too great.

             -Tim

             Reply

18. Madox,

    good info here. i have an 08 Mazda3 that i want to pull the codes from the EHPAS power steering controller that is on the CAN network. Were you able to pull codes from other controller in the car?Thanks

    Reply

    1. Hi, which other controller are you referring to?
       I did get the steering wheel position, one might assume that is from/to the steering controller.

       Reply

19. Hello Madox,

    It is the power steering pump controller (EHPAS System). It is physically under the front right heatlight inside the power steering pump. The dealer pulled up 2 codes B1318 – Battery voltage low and C1278 steering wheel angle fault. I am unable to see these code with a regular handheld emission OBD2 scanner. I am trying to get a scanner that can communicate with the controller. See link to someone in your next of the woods that is trying to mimic this controller

    http://www.oz-clubbies.com/forums/index.php?showtopic=5883&st=0&p=54494&#entry54494

    Most commercial software that can read this cost in the next of $260. What sofware are you using?

    Reply
20. Pingback: Interfacing with the CAN Network - Mazdaspeed Forums

21. I’ve got a late model Mazda and I’m wondering if you know if the remote key unlock data is available via the CAN bus.

    Ideally, I’d like to be able to put my own RFID unlock hardware into the car somehow for remote unlock, and would like to know if the idea is viable before buying my own CAN bus hardware.

    Reply

22. Hi. My ELM327 based OBD2 / CAN debugger works just great on the HS CAN, apart from its buffer filling because the data rate is too high. However, when I try to move its pins over from 6 & 14 to pins 3 & 11 to get to the MS CAN, I get nothing. Did your CAN debugger just work on the MS CAN, or was there something else which needed to be done as well?

    Thanks.

    Reply

    1. I’m not sure with your device, but the MS CAN runs 4 times slower than the HS CAN, so you might have to adjust your settings.

       Reply

    2. See my answer further down but you can bump up the speed of the ELM327, I got mine reading everything from the RX-8 (data rate is roughly 1Mb/min)

       Reply

23. Hi Madox,
    Thanks for your insightful information.

    I tried acquiring HS-CAN data from my RX-8 (2007 5MT Japan Model), but somehow the CAN format is different from yours.
    I’ve posted my analysis on my blog (perhaps it might be useful for other mazda cars).

    Then I overlaid CAN information on a on-vehicle movie.
    http://www.youtube.com/watch?v=1P50xbqpcZQ

    Reply

24. Hi Madox,
    Thanks for your insightful information.

    I tried acquiring HS-CAN data from my RX-8 (2007 5MT Japan Model), but somehow the CAN format is different from yours.
    I’ve posted my analysis on my blog (perhaps it might be useful for other mazda cars).
    http://blog.hiroaki.jp/2010/04/000469.html
    Then I overlaid CAN information on a on-vehicle movie.

    Reply

    1. cool!
       i made almost same? but in real time via Processing, with google maps static and HD webcam

       Reply

25. Does the 323F BG (1993) have a can bus? Can i recive/send data? What controller do i need? Sorry 4 my bad english!

    Reply

26. Anyone! First, I know nothing, but need to be able to feed the dash cluster foriegn signal(s), IE GM, and have it fully functional. Is this possible. The car in question is an 06′ miata getting a V8 swap.

    thanks

    Reply

    1. Assuming the instruments are CAN then yes it’s possible, I have a set of RX-8 clocks being driven from an arduino with a CAN interface. See http://imgur.com/EPIiV

       You’ll have to find some way to get the signals from the new ECU though, if it’s also CAN you may be able to just connect it to the bus and have an arduino listening for the ID’s and translating for the instruments. Otherwise you’ll need some way to get RPM etc into the arduino.

       Reply

27. Thanks for the great info, I’ve just got an ELM327 based device working on my 2006 Mazda 3 on the HS CAN bus. I’m using the Bluetooth OBD-II transceiver from DealExtreme.
    http://www.dealextreme.com/details.dx/sku.16921

    I’m having trouble with the buffer filling up while in “Monitor All” mode, but I guess that’s expected for such a cheap device.

    Reply

    1. Becouse speed RS-232 is 38400 bps, speed CAN is 500000 bps.

       Reply

    2. Not sure about bluetooth although ISTR it had a decent speed well above what the ELM327 would handle, I know the version with a USB interface will to up to 3Mbps, the ELM327 itself will do up to 500k (although then you are into module hacking as you have to set some custom serial speeds)

       The speed on the ELM327 can be changed by entering the following commands from a terminal (eg hyperterminal on Windows, cutecom under Linux).

       First set the speed, this is a divisor of 4000 and in hex, so for example here we have 38.4,57.6, 115.2, 230.4kbps.

       AT PP 0C SV 68
       AT PP 0C SV 45
       AT PP 0C SV 23
       AT PP 0C SV 11

       Pick your setting and apply it, then turn it on

       AT PP 0C ON

       Finally reset the device (or unplug and reconnect it).

       AT Z

       I’ve (personally) tried up to 230.4kbps without a problem which works fine without the engine running but still can’t cope at tickover (strangely it can when being revved), this may be due to having full headers on though, turning off spaces (AT S0), ie removing 1/3 of the data should be enough.

       Note that you won’t be able to use it with the normal tools until you reset it to 38.4k again, should it all go really pete tong you can reset the ELM327 by shorting a pin (see the ELM327 datasheet for details).

       Reply

       1. Just as an update, I turned off the spaces and it worked perfectly, I have a ~15min drive of *all* data to go through!

          Reply

28. Hi

    How should I send Can Message Identifier 0000020F?

    Reply

29. Hi, I am working on an interface to the CAN bus – basically I want to code an Arduino processor to emulate the “Rain Sensor” for those who replace their windshields with the non-OEM $1000 one. Do you know what I need to put on the CAN bus to tell the windshield wipers to wipe? This way Mazda owners could at least have a cheap solution for intermittent wipers.

    Reply

    1. Are you sure the rain sensor is on the CAN bus?

       There are quite a few accessories that is not on the CAN bus, it doesn’t make sense for me for it to be on. All it needs to do is to control the wipers. A lot of the accessories such as the passenger seat belt lights etc are controlled directly from the PJB (Passenger Junction Box) circuitry. I originally wanted to control those lovely seat belt figures 😉

       Reply

30. I want to discover some of the Extended PID’s on my Mazda3, namely knock retard.

    i was going to use a CAN sniffer, and spoof the knock sensor using an arduino. I figure I would be able to see information change, and based on the data I discover I may be able to determine the equation. I was going to use the MSD dashhawk to confirm my results.

    Do you think this is possible?

    Reply

    1. I don’t see why not. I actually bought an OBD-II Reader which I planned to use with a CAN Sniffer at the same time to help me decode more of the messages.

       The plan was to target a specific message (using OBD PIDs) and find the corresponding message on the CAN Sniffer, this approach should work for you if you know the PID of the Knock Sensor.

       Reply

       1. This is awesome news! I have a friend with a MSD Dash hawk, which is able to see all these extended PIDs.

          The reason why I ask is because I bought an OBD-II bluetooth module and the program Torque for my android phone. It would be SWEET if i can see some of the nifty E-PID data using torque, I just need to know the PID ID and equation, and I can have a gauge displayed on my phone. this would be so useful for doing road tuning on my mazdaspeed3 (and probably all late model mazdas).

          i am a mechanical engineer, not an electrical. however i am pretty savvy and interested in learning more. I would be extremely grateful for any help you can provide…

          Lets see if this makes sense:
          1) set up msd dashhawk to look at and display ONLY the knock retard PID (or whatever other pid i want)
          2) put the sniffer inbetween the dashhawk and the car
          3) find the message the dashhawk is requesting, thereby discovering the PID
          4) spoof the knock sensor with arduino to make the car freak out and spit out a bunch of different readings
          5) somehow using this data, i should be able to determine the equation of the PID.

          I am probably wrong in my approach, but half the fun is figuring it out! Any insight you can give would be awesome. Being that this is an extended PID, I have no information on the actual address of the PID.

          Thank You Tons in advance!

          Reply

          1. Actually it is different to what I would have done and I’m not sure it’ll work. The ODB-II is an ‘intrusive’ query protocol, the ODB-II tool requests information by query requests using defined PID codes.

             Somehow I think you’re using PID in the control context :> Though that doesn’t make much sense either… What are you trying to do again?

             Spoofing the sensor is going to be tricky…

             Reply

31. please delete my reply that has my name and email in it lol… I thought that the reply would require moderation before getting posted automatically…

    email me, and I will email you information on my setup. Thank You!

    Reply

32. Have you find anything about window controllers and CAN messages to pull the windows down? what about honking the horn?

    Thanks,
    Reza

    Reply

33. This is all mostly over my head, but Pieter Kapsenberg built a device to display canbus data on the stereo LCD.

    http://www.rx8club.com/showthread.php?p=3520268

    Maybe some duplication of effort?

    Reply

34. Hi,

    We are electrical engineering students and are trying to build a system that would open the windows of a Mazda 3. We have an OBD II to CAN interface and a CAN to USB cable which came with drivers and PCAN-View software. That software allows us to view the messages being transmitted on the network, but we are unsure whether the messages are from the MS or the HS CAN. Also, due to the large volume of messages and the fact that a lot of the messages keep changing despite us not doing anything to the car, we are unable to figure out which messages correspond to the windows and if the windows are connected to the CAN bus at all. Any suggestions as to how to go about this reverse engineering?

    Dharini

    Reply

    1. Hi,

       Last time I looked, the windows were directly controlled via wiring to the Passenger Junction Box (PJB) and then onto the motors. You can confirm this from the workshop manuals.

       To help isolate signals, I wrote a quick script that highlights if any byte in a message changes and be able to reset that. Worked a treat, had to ignore those constantly changing messages as you point out.

       Reply

35. I’ve been having a play with the CAN BUS on the RX-8 and a lot seems to match.

    Anyway as you’ve been a great help I thought I’d give some back:

    0x212 is abs, dsc off, traction control warning and brake warning
    0x300 is steering warning light
    0x420 is for temp and MIL/Oil warning/Coolant warning/Alternator warning (also oil pressure but while a ‘gauge’ it seems either on or off).

    0x430 is coming *from* the instruments, don’t know what it is.

    I’ll give some more details when I have it nicely arranged but you might still be able to get something more from that.

    Reply

36. does any one got CAN messages from steering wheel buttons?

    Reply

    1. On my 2006FL Mazda 3 at least, I get no change in CAN messages from pressing the wheel buttons [with the exception of the HU message change messages]

       Reply

       1. On my Mazda 3 I get 0x028F one bit changing on buttons press, volume wheel(same code for all buttns), info, clock, aux, cd, etc… but there is no chanses to get difference between volume up and down and no events on track up/down when media(aux) mode enabled, its just code of the event i guess…
          can’t believe, but there are codes of event without buttons codes )

          Reply

          1. Yes I’ve noticed the 0x28F bit changes too but couldn’t figure it out 🙂

             Reply

          2. On my 2005 Mazda3 with the Bose Sound i got the following mappings:

             none of the climate unit nor radio unit has special mapping except for two buttons

             28F -> Byte 4 -> Mask &0x10 -> Clock Button
             28F -> Byte 4 -> Mask &0x08 -> Info Button
             28F -> Byte 4 -> Mask &0x80 -> The rest of the mapped functions

             If you want to know which function is active:

             28F -> Byte 3 -> 0x00 FM1
             28F -> Byte 3 -> 0x22 FM2
             28F -> Byte 3 -> 0x18 EX/CD

             The only hope on this task is to sniff the HU unit protocol which is explained somewhere on the internets, I read some time ago a wiki about CD changer protocol and wheel buttons are mapped.

             Reply

             1. more info about CD changer protocol plz )

             2. Hello all,
                if the CD Changer protocol for Mazda still a thema here, so here is a small description of it: http://www.fun-electronic.net/wp-content/uploads/2009/02/mazda-3-radio-system-bus.mht
                And here is some articles about it:
                – with the protocol:
                http://www.fun-electronic.net/lang/de/2009/02/28/mazda-mp3-player-continue-2/
                – the whole thema:
                http://www.fun-electronic.net/tag/m-bus/

                The articles are available on russian and german, so you need to translate it (with google, for example), if you don’t speak/read this languages.

                Hope, it helps,

                Regards,
                MasterAlexei

37. Anyone know if there is a CAN PID that tells if cruise control is enabled? As well as the ACCEL and DECEL can pids ?

    Reply

    1. I found on my car (US 2008.5 Mazdaspeed 3) the following message related to cruise:

       0x4EA byte 0 is 0 when cruise off, 0x80 when on.

       Reply

       1. Thanks for the reply. I will have to check what is on 0x4Ea on the RX8 but as far as the cruise mode goes I found mine to be on 0x650. But then again, thats just to see if cruse is off or on. Any luck finding if there is a corresponding PID to see if ACCEL or DECEL are being pressed on the cruise control?

          Reply

          1. I should mention that this was on the HS-CAN. I don’t know about ACCEL or DECEL.

             I’ve been more focused on trying to find any MAF, MAP, or bost pressure data. Turns out it’s pretty tough to reverse engineer some of the scaling factors and units for the messages, let alone what they are in the first place.

             Reply

38. I’ve been working on reverse engineering some of the messages on the bus of my US-spec 2008 Mazdaspeed 3 with some success so far. Figured I’d post my (pretty raw) notes in case it helps anyone.

    I’d love help filling in the gaps in my knowledge if anyone has more information.

    https://spreadsheets.google.com/spreadsheet/ccc?key=0Ar4cjI7d0yP2dGRPUjZaZGo5MDU2TnpZTXl4blhUbVE&hl=en_US

    Reply

    1. Great work!, I need to do some work on the HS CAN later but I can confirm some of the PIDs with my 2005 Mazda3 2.0L.

       0x20F -> Byte 0,1 -> Brake Pressure (I think it’s MPRETDR PID as stated in service manual)
       0x205 -> Byte 2 -> Mask &0x40 -> Brake Pedal Switch (BOO_ABS PID in the manual)
       0x228 -> Same here clutch and neutral
       0x80 -> Same i think
       0x212 -> confirmed

       Reply

       1. I’d love to know what manual you have that specifies CAN bus PIDs. Sounds useful.

          Reply

          1. There are service manuals out there… if you search hard enough 🙂

             Reply

39. Just started to played a bit with my 2011 Mazda6 Euro and found one interesting:

    CAN ID Byte Bit Info Formula
    0x39e 0 0 Left front door 1 – open 0 – closed
    0x39e 0 1 Right front door
    0x39e 0 2 Left rear door
    0x39e 0 3 Right rear door
    0x39e 1 3 Boot 1 – open 0 – closed
    0x39e 2 0 Headlights 0 – off 1 – on

    Problem with my reversal engineering is cheap Chinese ELM327 v1.4 b clone. Looks like bluetooth module in it cannot programatically change the speed so I’m stuck with 36.4k baud transmission to PC and need to filter out a lot so it goes slowly. Anyone knows if I can somehow hack this thing so BT transmits faster than 36.4k to avoid BUFFER FULL even when sniffing all the can bus data?

    Reply

    1. If you can check on which chip BT module built, then it will be easy to check with datasheet supported speeds and how to enable them. Without this – it’s very hard to define. As another way, you can order another Chinese Elm327 clone – but USB version instead of BT 🙂 I own the same (USB), but want to make it both – USB and BT, as ELM itself needs only Rx/Tx, it’s easy to solve using needed mobule, either BT, or FTDI based USB.

       Reply

       1. Even USB versions of cheap chinese clones say its 38400 baud max…. 🙁
          If you can email me with link to “good” device which will allow better speeds it would be much appreciated.
          Address is marlasr(at)yahoo.com. Many thanks in advance.

          Anyway found another one interesting: 0x80 in bytes 0 and 1 has steering wheel position/angle.
          One interesting idea is to use this piece of information together with vehicle speed and calculate driven path, then compare it to the real path obtained via GPS. Already did cross-comparision with speed and values match surprisingly well. No usual “-5km/h” offset like on board gauge.

          At this point I stopped to play with TeraTerm and started writing some C# code to talk to the ELM.
          So far, I managed to connect to ELM, reset it, set speed (AT BRD) to 9600 and 38400 bauds as any other speed does not work correctly, calculate mask and filter for given bunch of ArbIDs… next is implementing filtered ATMA. I need two separate threads – producer that will populate the buffer with data read from ELM and consumer that will update the GUI using info provided and/or log to a file or whatever…

          Reply

40. I’m looking to get the odometer off a Mazda 6 2011 to display on my iPhone. Has anyone been able to do this? Do you know where to find it? The odometer for my 2007 Mazda 3 is in broadcast data but the 2011 Mazda 6 isn’t and I haven’t been able to find it.

    Reply

    1. Try with enhanced pid:

       Mode is 22, PID is 6182

       Reply

41. Hi,

    I just bought new Mazda 6 2.2 129 PS.
    Is there any way to reprogram and make automatic lights to work as a day lights. In Croatia day lights are mandatory, so instead having automatic lights when dark comes, I would like to have lights on every time I start the engine.

    As well I would like to have automatic door lock to lock the doors once I start driving as it is on some another cars available.

    Thanks,
    Alex

    Reply

42. I’d imagine the DRL (Daytime Running Lights) aren’t controlled by the computer, it just doesn’t make sense to do so. Same with the door locks, they’d be handled by the body computer and it probably only takes a direct digital input, not a command over the CAN bus. Either way, both can be solved easily with a micro, some code and a little interface work and never have to touch the ECU.

    Reply

43. Hello,

    I am working on a project that requires measuring individual wheel speeds. The problem is I have a 2011 Subaru WRX, and I was wondering how would I go about can bus sniffing to obtain those pids.

    Reply

44. Hello,
    I’ve got a Mazda5 2008 facelift.
    I took out my HU, so I’ve got empty connection to use with HS Can.
    My question is:
    What do I need to connect to Can system to send messages (speed and fuel level) into my car display?

    Looks like some conversion… to snif on Can and when speed message comes… convert address for a car display…
    and resend it to display part one.
    Similar sytuation is with a fuel level but it needs to be send to display part two…

    any ideas?

    btw. I chacked project on RX-8 but I don’t need that… to many things on it…

    Reply

45. Here are my notes about a similar Mazda 3 CAN monitoring project with some how-to information:

    http://she-devel.com/Mazda3_Controller_Area_Network_Experimentation.html

    I’d love to hear from anyone who has figured out more PIDs. I’ll post new PIDs as I discover or confirm them. So far my results look similar to what Madox has posted but I can’t yet confirm his interpretations.

    — Alison Chaiken, alison@she-devel.com

    Reply

46. Hey guys thanks for all the tips here, they have been most helpful. I do have a question though, I am trying to post a message to my lcd screen, but the messages “fight” with the radio. I try to send them as fast as possible with not much success. Here is a video of what I see. Any one else run into this?

    http://youtu.be/nSd5uOshcK4

    Reply

    1. ok looks like I fixed the fighting issue …. unfortunately now I am realizing that after sending a few messages to the screen the bluetooth and sat buttons stop responding.

       Reply

       1. Hello! You could achieve what some success against the radio?

          Reply

47. can anyone tell me the instrument cluster pinout for 12v ( 12v+ and GNd) and canbus (CANH & CANL )?

    Thanks.

    Reply

48. the pinout for RX8 (2003)

    Reply

49. Hi I have a project that I need help with and I have not been able to find any one who can help but it seems you might already have the info I need please email me runnin13s at yahoo.

    I have a 2004 Mazda rx8 with a camaro ls1 motor . I need the rx8 can bus instrument cluster to read/display the ls1 motors analog signals like rpm, coolant temp, oil
    I have purchased an ardruino UNO r3 micro controller and an elm327 from my research I have found I will need these items . But I am not computer savvy and have no idea how to program the ardruino to function properly and I know that te Mazda can bus codes is one of the biggest things I’ll need , can you maybe help?

    Reply

    1. I need to make this happen also, have you made any progress on yours?

       Reply

50. Hi Madox, would it be okay to create a version of this on my automotive reverse engineering Wiki? I’m trying to create a centralized location for CAN databases across all brands. With any luck, the DB should make things easier for those trying to get into the field. Of course, you would be credited as the original source. What we have so far appears here: http://vehicle-reverse-engineering.wikia.com/wiki/Vehicle_Reverse_Engineering_Wiki . Thanks!

    Reply

    1. Sure, no problem, thanks for asking 🙂

       Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.