Skip to content


Mostly harmless adventures with cars and tech

So it’s not always easy to work out which version of an RX-8 you’re viewing from the description the seller provides, and short of asking (which on an eBay auction can take forever) you have to go by visual cues. The major ones are summarised here and are valid for RX-8s between 2004 and 2007 (i.e. before R3 was launched).

192PS 231PS Notes
5-speed gearbox 6-speed gearbox
Halogen headlights Xenon headlights Tell-tale sign are the headlight washer pop-ups in the bumper below the headlights
Tach max of 9000RPM Tach max of 10000RPM

Also, just because it says it has HID / Xenon headlights doesn’t mean it has OEM lights – there are more than a few that have had the cheap’n'nasty aftermarkets fitted. In this case, it’s almost certainly a 192 and it won’t have the mandatory auto-levelling  and washers, meaning that it’ll be an MOT fail without refitting the original halogen lamps. Check for the washers in the front bumper and for the auto-levelling warning light on startup.

I use these little Perle IOLan serial-to-IP adaptors for various applications, but had one instance recently where the device was not listening on TCP/10001.

Perle's incredibly useful IOLAN DS1 IP-to-serial device server

Perle’s incredibly useful IOLAN DS1 IP-to-serial device server

After a lot of head-scratching, it was a simple case of someone having toggled the Console / Serial hardware switch from the off (serial) position to on (console) – this prevents the Trueport service starting on the device and hence it no longer listens on TCP/10001 for incoming connections to the serial port.

Toggle switch in the correc (off) position to allow incoming network connections

Toggle switch in the correc (off) position to allow incoming network connections

Not one bit of googling actually mentioned this directly, and neither did the device’s very good manual. Hope it might save someone a few moments in the future :-)

In order to see how easy it would be to mess around with this car’s on-board systems, I figured the easiest and cheapest way would be to buy an old instrument cluster from eBay and see what I could get it to do.
In reasonably short order (two evenings after work) I managed to get most of the major functions working. All of the stuff you’re about to read was performed without access to an actual vehicle, just to its instrument panel and the internet ;-)

So, before we get started, here’s a video to see what can be done with about 8 hours of poking around:

The RX-8 is reasonably simple from an electrical system point of view in that it only has a single, high-speed CAN bus that links most of the major vehicle subsystems together. There are many other good references that explan exactly what CAN bus is and exactly how it works, so I’ll simply summarise it here.

Typically, the CAN bus comprises of a twisted-pair of wires, terminated at each end by a 120Ω resistor. It’s a differential bus (i.e. each signal has a “mirror” of it on the second wire) and also not ground-referenced, meaning it can put up with a reasonable amount of disparity between the ground potentials of different nodes. This tends to make it quite robust and hence well suited for the nightmare of an electrical environment present in a car.

The CAN bus is literally that – a common data channel to which all participating nodes can listen simultaneously whilst one of the nodes talks. This also means that it inherently a broadcast arrangement – anything that any one node says can be heard by any of the other nodes on the bus. As such, all you need to do to “talk to” a CAN device is send data to the bus that the particular device is listening for, such as vehicle road speed or engine temperature. If you can compose a valid message and transmit it, there’s a fair likelihood you’ll get the device to respond. In the case of an instrument panel, this response is usually visual in that a warning indicator will light up or a gauge move.

In order to play this game, some hardware is needed that can take the messages you want to send to the bus and turn them into the actual electrical impluses required. As ever, the most convenient and accessible way of doing this for me was with the ubiquitous Arduino microcontroller board and a CAN bus interface shield (in Arduino parlance, a shield is an add-on board that matches the Arduino’s footprint and stacks on to the pin headears either side of the board, making it very easy to use).

The total bill of materials for this exercise is as follows:

  • RX-8 instrument cluster (eBay, £15 for mine)
  • Arduino Uno (SKPang, £23.88)
  • SparkFun CAN bus shield for Arduino (SKPang, £36)
  • Arduino development environment, available for Mac, Linux and Windows (free, downloadable from the Arduino web site)
  • Cory J. Fowler’s MCP2515 Arduino library, which does all of the hard work with respect to talking to the CAN bus (free from GitHub)
  • One 120Ω resistor to terminate the Arduino end of the CAN bus (the instrument panel has a 120Ω resistor already in it)
  • Female DB9 connector to hook up to the CAN shield
  • 12v power supply to power the instrument cluster
  • USB cable to connect your computer to the Arduino
  • Miscellaneous wire, soldering tools etc.

Given the amount of stuff I had knocking around already, all I needed to buy was the CAN shield and the instrument cluster, coming to about £60 delivered.

The Mazda RX-8 wiring diagrams are available as part of the car’s service manual, located here, and the section relating to the instrument cluster is on page 28 of chapter 13. This allows you to locate the five most interesting pins: Ground, constant 12v, switched 12v, and the two CAN bus pins. All of these are located on the ‘A’ (smaller) connector.

As I didn’t have a proper wiring loom available, I simply cut away the socket shroud and soldered wires for power, ground and CAN directly to the pins of the connector, however if you’re working with an instrument cluster from your own vehicle I’d strongly recommend using connectors of some sort, even if they just push over the pins, so that you can re-use the cluster in your car again!

Applying power to the constant 12v input causes the cluster to initialise by sweeping all of the analogue gauges to find their zero positions. If you apply 12v to the switched input, the cluster will then illuminate white as it is when you turn on the car’s ignition.

It’s important to note at this stage that there are many indicators that come on of their own accord. Some, such as the fuel low or SRS warning lights, are looking for an input on a dedicated wire. Others, such as the ABS, water low, low oil pressure, charge and check engine lights appear as the instrument cluster’s microcontroller isn’t hearing anything on the CAN bus from the ECUs responsible for them, so it fails ‘safe’ by informing the driver there is an error with those systems.

Hook up the CAN shield to the CAN bus pins on the instrument panel, and it’s ready to talk.

I wrote some simple code to ‘fuzz’ the  instrument panel. CAN messages, in their most common form, comprise of an address, a message type, a length field and one or more bytes of data. From information I’d found on this site, CAN message identifier 0×201 looked interesting, so I set all the bits in the 8-byte data payload high. This resulted in the rev counter going full scale, so we had a winner :-)

To cut a long story short, a couple of hours noodling around with this produced the following abysmal example of how not to code, but nonetheless it worked well enough to make the YouTube video that probably brought you to this blog entry :-) It’s being re-written to use a timer interrupt routine to handle the CAN traffic rather than having the periodicity of the CAN messages determined by how often the control loop cycles; nonetheless it should get you started on talking to CAN devices:


So I have a bit of a random plan to do with my next car project, and as it’s my plan, this inherently means it’s over-ambitious, prone to failure and would probably be considered by most sane people to be a Bad Idea.

That notwithstanding, these things are usually a bit of a giggle and I learn a heap of stuff on the way even if they do end in abject failure, so I’m pressing on.

The subject of this next automotive folly is the Mazda RX-8 – a four-but-it-looks-like-two doored, front-engined, rear-wheel-driven, 52/48-split weight distributed, torsen-diff-equpped sports thing, made unique by it’s use of a compact and preposterously light Wankel rotary engine.

Because of the unique attributes of this drivetrain along with the way that they are packaged, it’s very well balanced and has a low yaw moment due to the engine being completely behind the front wheels. The centre of gravity is also very low given the near-cylindrical profile of that rotary engine, meaning body roll is also reduced. It’s very light too at approximately 80KG for the bare engine.

Another reasonably interesting attribute is their percieved lack of reliability, and the primary reason for this car’s choice as my next project. The 13B rotary engine these cars use suffers in reputation in a similar way and for a similar reason that the 215CuIn Buick Fireball (more recently known as the ubiquitous Rover V8) did in the states. All engines at that time were of steel construction and the antifreeze commonly used with these steel motors would react unfavourably with the aluminium, causing the cooling galleries to fur up, restrict water flow and cause engine damage.

Similarly, the 13B is infamous for starting problems caused by loss of compression due to excessively worn rotor apex seals (the seals at the tips of the triangular rotor). I know from first hand experience that these engines are often good for 120,000 miles or more, but they do require very particular maintenance. The engine’s management computer has control over an auxiliary oil pump that introduces sump oil directly in to the combustion chambers to help seal and lubricate these critical rotor tips, hence the reason they have a reputation for using oil.

The thing is, they do use oil – by design and by very careful computer control of it! The oil, being introduced into the combustion chamber in this manner, gets burnt along with the fuel. As such, the use of incorrect oil – notably synthetic types – interferes with this total-loss oiling system. Most people will think synthetic oil is better for their engine and, in most cases, they’d be right; however it’s particularly unsuited for use in a rotary.

Synthetic oil is very robust – it is engineered to be that way (and hence why service intervals can be extended on regular cars as it doesn’t denature anywhere near as quickly as mineral oil) – and consequently burns with a very sooty flame whilst leaving a very gummy, gungy residue behind. The soot and other combustion byproducts get shoved out of the exhaust, clogging up the exhaust ports and, more critically, the catalytic converter, which explains their reputation for getting through cats at a rate of knots also.

The gungy residue gets in to the seal journals and under the springs, impeding their motion and preventing them from providing an adequte seal. Compression drops due to blow-by which in turn causes poor economy, a drop in power output and starting problems.

To add insult to injury, if the vehicle becomes hard to start (or is flooded by shutting it down before it’s warmed up sufficiently), the combustion chambers become flooded with fuel which washes away the lubricating oil from the seals, causing even more compression loss and accelerated wear of the seals and chamber walls as the clueless driver continually cranks away at the thing praying it’ll start.

Because of these characteristics, many rotaries expire well before their time due to excessive seal wear and combustion chamber damage due to lack of lubrication. This means the cars themselves have a very bad reputation and a related low sale value. A vehicle that’s been run on mineral oil its whole life will run well over 100,000 miles, but many expire well before that, making non-runners available for less than a grand, and a half-decent running car for a little more than twice that.

This actually makes them ideal for my purposes – they’re a modern (introduced 2003), safe (top roll-over rated car in american crash tests, front, side and curtain air bags, dynamic stability control), well built (Japanese) platform that is available at a very competitive price.

They have toys such as electronic power steering, sat nav and parking radar and – and this is where the first bit of research comes in – have a reasonably simple single CAN bus control architecture that allows you to mess around with the powertrain (i.e. remove the rotary altogether) without significantly upsetting the other components.

I intend to run two of these cars – one as the designers intended as a daily driver and to act as a baseline reference, and one as a project mule that’ll be messed with. The rest of the posts in this section will detail the work and progress of this project as and when it progresses.


Jun 12


All I need now is for ICANN to approve the .hodor top-level domain…

So with the ST205 in pieces, the ST185 needing a complete teardown and rebuild and the truck having exploded (it’s still on the naughty step because of its tantrum at the moment) I needed a random car to move me to work and back. Thankfully, one of my colleagues sold me a 2001 Mondeo estate for the princely sum of £300, and I am quite astonished how good it is.

There are known problems: the clutch is only just clinging to life and the release bearing yowls like an angry cat when you press the pedal, but other than that, everything works! What’s more the gearbox is good, engine is good (and had a cam belt done approximately 40,000 miles ago), the ride is quite frankly excellent and it is a perfectly pleasant way to waft to and from work.

It’s by no means quick and it won’t thank you for hurrying it around a corner, but as a “Plan B” car, it’s perfectly fine. I have to admit that I’ve always had the preconception that they were a bit naff, but the interior’s worn well and there’s not a single squeak or knock anywhere. Even the remote boot release works! Very impressed…

Whilst blocking entire countries (hi China!) from my mail server, I stumbled across this little gem in the form of a whois driveby.

In looking at a particular IP address, I found this domain name and out of routine did a whois lookup:


Fine so far, but as the contact details were pulled, this appeared:


If you happened to be using a web-based whois servce, specifically one that’s not careful about sanitising the output of whichever whois server it’s using, you may well end up performing a remote file include on yourself! Obviously this is fairly benign when done from the command line, but from a badly coded web whois client it has the potential to be a bit… sneaky!

Just for completeness, I pulled the referenced file and it contained nothing but a line that writes a null string to the document, but that’s not to say that it wouldn’t have something a little more interesting should an appropriate referrer and user-agent be reported at GET time…

From having a rummage around to see if anyone else had spotted this, it looks like it was done by the registry to insert their logo in web-based whois lookups, but that still doesn’t make me feel any happier about it!

That is how much Halfords want to charge for reading out the codes from a friend’s car because it had a “check engine” light on. Really? I mean, one of these plus this bit of software and you have a tool that you can use over and over and over again for less money than they want to charge you for one code-pull!


Absolutely fascinating talk – well worth a watch…


Well – the unbreakable vehicle has broken at only 280,000 miles :-(