Mazda Entertainment System - Bus Protocol

The message bus on Mazda head units use a simple communication protocol. The bus idles at 5V and is pulled down to 0V to send data pulses. Logical ones and zeros are defined by how long the bus is pulled down, see Timing for details. The protocol uses nibbles instead of bytes; most messages don't line up to a byte boundary (for instance, the shortest message is 12 bits).

Message Protocol

Purpose	Length (nibbles)	Notes
Destination Module	1	0x0 = Tape deck 0x1 = (Unknown) 0x3 = CD deck 0x5 = CD changer (external) 0x6 = CD changer (upper module) 0x7 = MD deck 0x8 = Base unit If the first bit of this nibble is 1, the command is destined for the base unit and the remaining 3 bits let the base unit know which module it came from. Therefore if the CD deck wants to send a message to the base unit this nibble will be 0x3 + 0x8 which is 0xB (or b1011). If the first bit is 0, then the message originates from the base unit.
Command	1
Message data	0..n	Message specific
Checksum	1	XOR all the nibbles, add 1 and ignore any overflow. Example: If the message is 0x311012, the checksum calculated as follows: (3^1^1^0^1^2 + 1) & 0xF = 1

Messages Sent By The Base Unit

Command	Data Length (nibbles)	Purpose	Data Format
0x1	4 or 5	Control	See Control Command Data Format
0x8	0	Anybody home?	No data
0x9	0	Wake up	No data

Control Command Data Format

Subcommand	Purpose	Data Format	Details
1	Playback control	XX2	XX is: 0x01 for play 0x04 for ff 0x08 for rew 0x60 for stop
0x3	Seek to track	0KK1	KK is the (BCD encoded) track to seek to
0x4	Set configuration data (CD Deck)	RR00	RR is: 0x02 for random mode 0x08 for "SCAN" mode (plays 10s of each song) 0x40 for repeat mode
0x4	Set configuration data (Tape Deck)	RR0	RR is: 0x01 for repeat mode 0x02 for random mode 0x10 for fast fast-forwarding (when the up-seek button is pressed) 0x20 for fast rewinding (when the down-seek button is pressed)

Messages Sent by the CD Deck

Command	Data Length (nibbles)	Purpose	Data Format	Details
0x8	1	Wakeup notification	0x1	Sent after connecting power
0x9	13	Status	NPPQRSSTTWXYZ	N is: 0x0 - stopped 0x4 - playing 0x5 - seeking 0x6 - fast forwarding 0x7 - rewinding PP is the current track number (BCD encoded) QR is unknown but suspected to be current CD number in a CD changer (always 0x01) SS is the current position in minutes (BCD encoded) TT is the current position in seconds (BCD encoded) W is 0x4 when repeat is on, 0x0 otherwise X is 0x2 when random is on, 0x0 otherwise Y is unknown (always seems to be 0x0) Z is unknown (always either 0x1 or 0xC)
0xB	9	Hardware status	various	0x910000001 - sent when the device enters playback mode 0x91000000C - disk present (sent multiple times during startup if disk is present) 0x91XX0000C - used when the radio is woken up, XX is current track number (BCD encoded) 0xA0006000C - no disk present (always sent once during startup, after 0x8 command) 0xA0008000C - ejecting 0xB1006000C - disk being inserted
0xC	10	Disk info	STTWWXXYYZ	S is 0x0 for no CD, 0x1 for CD in drive TT is the BCD encoding of the first track number on the CD WW is the BCD encoding of the last track number on the CD XX is the BCD encoding of the total playing minutes YY is the BCD encoding of the total playing seconds Z seems to be 0x0 for no CD, 0xF otherwise
0xD	15	Unknown	0x000000000000000 0x100000000000800	This may have something to do with whether or not a CD is present. The first format (0x000...) only appears when there is no CD in the drive and the second format (0x100...) only appears when there is a CD in the drive.

Messages Sent by the Tape Deck

Command	Data Length (nibbles)	Purpose	Data Format	Details
0x8	1	Wakeup notification	0x1	Sent after the base unit sends the first "Wake Up" command
0x9	2	Status	NP	N is: 0x0 - stopped 0x4 - playing 0x5 - seeking 0x6 - fast forwarding 0x7 - rewinding P is 0x1 when the tape deck in use, 0xC for all other status messages (like on startup)
0xB	6	Detailed status	various	0x90X00C - sent during initialization, X is: 0x0 for no cassette present 0x4 for cassette present 0x90Y001 - sent when the tape deck is in use, Y is: 0x4 for normal playback 0x5 when repeat mode is on 0x6 when random mode is on 0x9Z4011 - high speed fast-forward/rewind, Z is: 0x2 for fast forward with the seek button 0x3 for re-wind with the seek button 0xA40004 - sent while the tape deck is ejecting 0xA0000C - sent when the cassette is finally ejected 0xB0400C - sent when a tape is inserted For any of these commands, when the Dolby noise reduction mode is on, the 4th nibble will be 0x1. For example: 0x904001 indicates normal playback, but with dolby noise reduction on it will be 0x904101.

Timing

The radio seems to be very forgiving when it comes to the duration of various signals. The CD player in particular is very inconsistent; in the same nibble it'll send a logical zero which lasts 0.4ms and then another that lasts 0.55ms, the radio doesn't seem to care.

Operation	Duration (milliseconds)
Logical 0	0.4 - 0.6
Logical 1	1.7
Wait after sending logical 0	2.4
Wait after sending logical 1	1.2
Wait between nibbles	0 - 5
Wait between commands	10 - 50

Timing Diagrams

These diagrams are to give an idea of what timing is like on the bus. This particular diagram is of the initialization sequence (without the CD player). The x axis is in microseconds (10^-6 seconds).

The same 6 "Wake Up" commands are sent 4 times

Each command block is made up of 6 commands

The first command (0x38C)

See Also

Mazda Entertainment System

• Bus protocol documentation
• Connector Documentation
• Capturing bus data
• Sample bus data dumps
• MazdaSpoof - A Tape Deck Emulator