CAN Messages


  • Incomplete, expect errors, work in progress!
  • Method: CAN sniffing and/or ROM disassembly.
  • Models: Specifically MY 2009/2010 Impreza 2.0 Turbo Diesel EDM (Euro 4). MY2011 (Euro 5) Impreza and other models seem to share many of these. Euro 6 diesel contents probably differ a lot – anyone able to provide sniff data?


There are 15 CAN-IDs to be found on the high-speed bus (500 kbps, easily available via OBD-II connection), excluding any communication with a tester device.

CAN-ID Interval [ms] Source Read by Comment
0x2 10 Steering Sensor VDC/ABS steering angle
0x70 20 Yaw/G Sensor VDC/ABS ???
0x75 20 Yaw/G Sensor VDC/ABS ???
0x80 20 Yaw/G Sensor VDC/ABS ???
0x410 10 ECU (TCU), … Engine speed, accelerator, torque …
0x411 10 ECU Gear, flags, …
0x501 20 VDC/ABS ECU Torque, flags
0x511 20 VDC/ABS Steering wheel angle
0x512 20 VDC/ABS ECU Vehicle speed, flags
0x513 20 VDC/ABS ECU Individual wheel speeds
0x514 20 BIU ECU Ambient temp, fuel level, switches,…
0x550 50 Electric Power Steering ECU Electric current
0x576 20
0x600 50 ECU Coolant temperature, indication lights, …
0x620 20 BIU or A/C ECU A/C flags…

Steering Sensor CAN-ID 0x2

Sent every 1/100 second.
Ex "BE FF ED 06 00 00 00 01"

Byte# (0-7) Description
0 & 1 Steering Wheel Angle, int16, little endian, (x [deg])
  • high nibble: XOR of nibbles (except last byte at least)
  • low nibble: counter
3 flags ? (mostly zero, sometimes 06)
4-7 const

ECU CAN-ID 0x410

Sent every 1/100 second.

Byte# (0-7) Description
0 const 0
1 Transmission Torque ??? (x*1.6 [Nm]) (0 when idling}
2 Engine Torque ??? (x*1.6 [Nm])
3 Torque Loss ??? (x*1.6 [Nm])
4 Accelerator Position (x*100/255 [%])
5 & 6 Engine Speed, uint16, little endian (x [1/min]) {Ex: 20 03 = 0x0320 = 800 [1/min]} Petrol ECUs and TCUs also write/read this one, respectively.
7 bit 0: ??? (const 1)

bit 2: A/C Compressor Signal (clutch engaged)

(all other bits unused)

ECU CAN-ID 0x411

Sent every 1/100 second.

Byte# (0-7) Description
1 & 2 ??? uint16, little endian
3 const 0 ???
4 Gear (0 – 6)
5 Memorized Cruise Speed (x [km/h]) {0x25 = 37 km/h}
6 Flags
bit 7: CC SET Light CC Set Light
bit 6: CC CRUISE Light CC Cruise Light
bit 4: Brake SW
7 bit 0: MIL MIL


Sent every 20 ms = 1/50 second.

Byte# (0-7) Description
2 Torque Reduction ??? (x*1.6 [Nm])
3 Torque Allowed ??? (x*1.6 [Nm])
4 bit 2: ???
bit 1: ???
bit 0: Request Torque Down
5 counter


Sent every 20 ms = 1/50 second.

Byte# (0-7) Description
0 & 1 Steering Wheel Angle (x [deg]), int16, little endian, negative = left, positive = right
2 & 3 Steering Torque ???
4 Brake Percentage (1-100%) ??? (x*0.4 [%]) ???


Sent every 20 ms = 1/50 second.

Byte# (0-7) Description
0 Flags
bit 4: VDC Switch (ON/OFF)
1 Flags ?
2 & 3 Vehicle Speed, uint16, little endian (x*0.05625 [km/h])

  • average of front wheel speeds
  • lowest non-zero value seen: 0x0021
4 Flags
bit 4: Brake Switch
5 counter
6 & 7 latest f-code, uint16, little endian


Sent every 20 ms = 1/50 second.

Byte# (0-7) Description
0 & 1 Wheel Speed Front Left, uint16, little endian (x*0.05625 [km/h])

  • lowest non-zero value seen: 0x0022 = 1.9 km/h
2 & 3 Wheel Speed Front Right
4 & 5 Wheel Speed Rear Left
6 & 7 Wheel Speed Rear Right

BIU CAN-ID 0x514

Sent every 20 ms = 1/50 second.

Byte# (0-7) Description
0 bit 2: Reverse Gear Switch ?

AT (petrol) models: (?)

bit 6: downshift
bit 5: upshift
bit 4: sport mode

1 (Error-) flags
2 Ambient Temperature (x/2-40 [°C])

  • 0xFE means no data yet
  • digitized by combination meter which also commands the primitive center display (clock, temperature, fuel consumption)
  • not read by diesel ECU as it has inlet air temperature sensor
3 bit 6: Wiper SW
bit 3: High Beam ?
bit 2: Low Beam ?
bit 1: Light SW (parking/clearance/DRL lights already)
bit 0: Defogger SW
4 bits 7 & 6: Fuel Level Resistance, bits 1 & 0
bits 0 & 1: Blower Fan ON (bit 0: low output, bit 1: high output)
5 Fuel Level Resistance, bits 9-2 of total 10 bits (x/10 [Ω])

  • raw, fluctuates a lot when moving, needs damping algorithm (done by dashboard computer)
6 counter (low nibble, odd values only?)
7 Flags, not read by diesel ECU?
bit 7: Handbrake/Parking Brake SW Brake Light

Power Steering CAN-ID 0x550

Sent every 50 ms = 1/20 second.

Byte# (0-7) Description
0 Status flags?
1 & 2 Electric Power Steering Current, uint16, big endian (x/10 [A])

  • 0xFFFF when engine off
7 counter

ECU CAN-ID 0x600

Sent every 50 ms = 1/20 second.

Byte# (0-7) Description
0 bit 0: Glow Light Glow Light
bit 1: DPF Light (ECU also does the flashing mode by turning on/off repeatedly; used in Diesel ECU Patch v1)
bit 2: ???
bit 3: ???
1 & 2 Fuel Consumption, uint16, little endian, (x [mm³/s])
3 Coolant Temperature (x-40 [°C])

  • 0xFF in case of sensor trouble
4 counter
5 const 0xA2 (from data segment)
6 bit 2: Clutch SW
7 const 0xFF

BIU (A/C) CAN-ID 0x620

Sent every 20 ms = 1/50 second.

Byte# (0-7) Description
0 bit 7: Two interior heaters ON
bit 6: One interior heater ON
bit 4: ???
1 bit 2: Radiator Fan Request ???
bit 1: A/C Compressor ON Request
bit 0: A/C Switch


  • 2017-03 CAN-ID 0x2, Steering Sensor: XOR checksum, thanks to Phil Brooks.

37 responses to “CAN Messages

  1. A test run I made provided me with the following ID:s on the CAN bus:
    This is on my MY10 Legacy (Swedish)


    • Nice! Please send zipped logfile(s) to official email address (see page “About”).
      I might write a small tool to improve the log format a little bit.
      Seems like Euro5 IDs are totally different, now let’s see if contents have similarities…


  2. 0x511 – source: vdc/abs
    0x002 – source: steering sensor
    0x070/0x080 -source: yaw/g sensor


  3. Anderson Huang

    Dear Sir

    My car is 2008 impreza WRX (GH8), did you have the OBDII message ID for my car??
    I’m find very long time, but still can’t get the information.
    And sorry to disturb you.


    • You’re welcome. Can you rephrase your question?
      2008 certainly must have CAN as physical transportation layer.
      OBDII is sort of content protocol, like SSM2, can be implemented via serial line – on older cars, too.
      Not sure what you mean by “OBDII message ID”…
      Are you doing raw CAN analysis or OBDII protocol (on top of CAN/ISO15765) ?
      Standard OBDII should work on any car. Tester CAN-ID the ECU listens to should be 0x7E0 also.


  4. Anderson Huang

    I am sorry my question is not clear.
    Currently i have a MCU support the CAN BUS and i can control the MCU to transfer,receiver or listen the can bus message.
    How can i read the vehicle speed through OBDII CAN BUS ,they are too many message(ID) on can bus??

    Liked by 1 person

    • Hi! Ok, so you’ve connected transceiver hardware to CAN bus (via OBDII-socket = high-speed bus)…
      As there’s no standard required internally, CAN-IDs and content format are entirely manufacturer + model specific.
      Like we did on this page, you have to analyze (all) CAN frames in order to find data you need. Not an easy job without special CAN analyzer software. Many infos were found or confirmed via ECU ROM so we didn’t need extra software.
      At last, you probably want to setup hardware to ignore all unneeded CAN frames and just read the needed ones…
      If you’re lucky your model uses similar CAN-IDs as Impreza diesel. We’re busy developing diesel stuff, no time to reverse WRX ROMs I’m afraid.


  5. Anderson Huang

    Dear Subdiesel
    Very thanks for your enthusiastic response.
    I will according to your suggestions to analyzes all can bus frames.
    Thanks again.


  6. I’ve found on my 2011 Impreza 2.5 (Canada) that Byte 7 Bit 0 of 0x514 is the park brake status. Probably for the park brake light indicator.


  7. 0x70 and 0x80 from Bosch Module , following an extract of the dbc file , tested with subaru impreza 2010 or 2011:

    0x80 = 128 decimal
    0x70 = 112 decimal

    BO_ 128 DRS_TX_ID2: 8 DRS_MM3x
    SG_ AX1 : 32|16@1+ (0.00012742,-4.1768) [-4.1768|4.1765] “g” ABS
    SG_ YawAcc : 0|16@1+ (0.125,-4096) [-4096|4095] “°/s²” ABS

    BO_ 112 DRS_TX_ID1: 8 DRS_MM3x
    SG_ AY1 : 32|16@1+ (0.00012742,-4.1768) [-4.1768|4.1765] “g” ABS
    SG_ Yaw : 0|16@1+ (0.005,-163.84) [-163.84|163.83] “°/s” ABS


  8. someone have extra info about fuel level ?
    from CAN BUS or SSm protocol , it is possibile to get fuel level sensor value resistor or voltage , but it seem not to be present a calibrated fuel level percentage value ?

    someone haver try to check fuel level sensor (voltage or resistor value) in various fuel level condition ,
    in other words , if someone have created a similar table :

    Subaru Dash Fuel Sensor resistor Fuel Sensor voltage
    fuel level indicator
    0% xxxx 4.85V
    25% xxxx yyyy
    50% xxxx zzzz
    75% xxxx xxxxx
    100% xxxx 0.5V


  9. Hello,

    I am working on a project that requires measuring individual wheel speed. Are the PID posted here will work for a 2011 Subaru WRX american version? If not how would I go about can bus sniffing?


  10. Dear Sir

    My car is 2008 impreza WRX STI (GRB) 2.0L Turbo(Not Diesel) 6MT.

    ID 0x550 was not found on CAN-BUS. Because my car has a hydraulic steering pump.
    But, all of other IDs listed this page were found. Thank you for your work.

    I also found other four CAN-IDs on CAN-BUS.
    0x412, 0x601 @interval 10ms?
    0x430 ,0x576 @inerval 20ms?

    Now ,I’m going to make real-time fuel efficiency display. Thanks.


  11. ID 0x70 BYTE 0 + BYTE 1 (16 bits) is yaw rate : (RAW * 0.005) -163.84) = YAW °/s [range -163.84|163.83]
    ID 0x70 BYTE 4 + BYTE 5 (16 bits) is Y Acceler : (RAW * 0.00012742) –4.1768) = Y ACC “g” [range -4.1768|4.1765]

    ID 0x70 BYTE 0 + BYTE 1 (16 bits) is yaw Accel : (RAW * 0.125) -4096) = YAW ACC °/s2 [range -4096|4095]
    ID 0x70 BYTE 4 + BYTE 5 (16 bits) is Y Acceler : (RAW * 0.00012742) –4.1768) = Y ACC “g” [range -4.1768|4.1765]

    ID 0x411 BYTE 7 , bit 3/4 is Map Selected
    example (BYTE 7 = 0x2C – binary 001 01 100) = SPORT / SHARP “bits 01”
    example (BYTE 7 = 0x3C – binary 001 11 100) = SPORT “bits 11”
    example (BYTE 7 = 0x34 – binary 001 10 100)= INTELLIGENTE “bits 10”

    ID 0x412 BYTE 5 another similar Throtthle position RAW * 100 / 255 , FULL GAS = 255 decimal , CLOSE GAS
    about 20 decimal

    ID 0x430 BYTE 1 is Differential Control
    Bit 3 = 1 “Auto” , 0 “Manual”
    Bit 0/1 = 11 is “+” , 10 is “-” , 01 “no change” , 01 also in Manual /automatic mode

    ID 0x430 BYTE 2 is Differential Control level

    000 – 1 level (all free)
    001 – 2 level
    010 – 3 level
    011 – 4 level
    100 – 5 level
    101 – 6 level (all blocked)
    When “AUTO” select Diff control level is always 000

    SUBDiesel , I want to mix engine informations get from Main CAN BUS line and through SSM 2 CAN , because for
    example intake air temperature etc .. is available only through SSM protocol , can you send me an explanation of
    how to build a request message to ECU through SSM 2 CAN , i read the SSM2 CAN section but it is not 100% clear
    I known only old SSM through K Line , can you send me a “dump of CAN BUS traffic” with CAN Analyzer ?


  12. Just to add a bit to the above from the 2012 Subaru Forester Diesel:

    Hope this is going to come in handy for somebody.

    [HS CAN (OBD connector pins 6&14) @ 500kbps]
    0x514 [D7] [bit7] – Handbrake(park brake) status: Set – ON, Clear – OFF
    0x514 [D0] [bit2] – Reverse Gear switch (manual gearbox) status: Set – ON, Clear – OFF
    0x514 [D3] [bit1] – Sidelight/parking light status: Set – ON, Clear – OFF
    0x514 [D3] [bit2] – Low Beam status: Set – ON, Clear – OFF
    0x514 [D3] [bit3] – High Beam status: Set – ON, Clear – OFF

    0x512 [D4][bit4] – Footbrake status: Set – ON, Clear – OFF
    0x512 [D0][bit4] – ESP switch status: Set – Switch ON, Clear – Switch OFF

    0x511 [D4] – Footbrake percentage (1-100%) ~x*0.4

    [MS CAN (twisted cable pair at the dashboard: pink & blue) @ 125kbps]
    0x10 – to do with immobilizing system, sends coded messages to ECU in order to authorize/deny engine start. (Work in prgs)
    0x11 – same as above different node. (Work in prgrs)

    0x23 [B3] [bit6] – ignition key in: Clear – key removed, Set – key present
    0x23 [B3] [bit7] – Accessories position status: Clear – ACC OFF, Set – ACC ON
    0x23 [B3] [bit0] – Front right door status: Clear – Closed, Set – Open
    0x23 [B3] [bit1] – Front left door status: Clear – Closed, Set – Open
    0x23 [B3] [bit2] – Rear right door status: Clear – Closed, Set – Open
    0x23 [B3] [bit3] – Rear left door status: Clear – Closed, Set – Open
    0x23 [B3] [bit4] – Tailgate status: Clear – closed, Set – Open

    0x40 [B0] [bit7] – Ignition status: Set – ON, Clear – OFF
    0x40 [B7] [bit3] – Engine running status: Set – Engine running, Clear – Engine OFF

    0x41 [B4 MSB … B6 LSB] – Odometer readings 1bit/km

    0x81 [B7] [bit0] – Drivers seat belt status: Set – unbuckled, Clear – buckled

    Liked by 1 person

    • Just revisited this stuff, better late than never…
      Took your high-speed findings, could confirm some items easily, others I cannot confirm without hardware to play with, added them anyway.
      Thanks a lot for those details, I might also create a page using your body-CAN results.
      Let me know if you have got any updates.


  13. Dear Subdiesel
    I wanted to make HUD for my Impreza (2008MY s-gt(wrx) ) and your website really helped me!!
    Thanks a lot for your work!!
    For your interest, I’ve found out that on ID 0x411 6th byte (where the brake sw is),
    bit 1 and 7 turns to ‘1’ when the cruise control is in standby,
    bit 0 and 6 turns to ‘1’ when the cruise control is active.


  14. Ok so I just getting into this game of reverse engineering the CAN messages. Right now I have built my own custom board that has an MCP2515 and MCP2551 with an ATMega328p with an arduino bootloader. I’ve wrote a few sketches that dump data over a serial connection that I log with PuTTy into a tsv/csv file. After that I can start digging through it all inside of excel for now.

    I’m wondering what suggestions you all have for working things out. Should I sit in the car and watch the live stream ofa particular ID/Byte/bit as I do something. I.E. I could filter the 0x514 ID and Byte 3 then just print the changes. then mess with the lights and wipers. That should work for boolean values or simple things but how would you ever find something more complex like steering wheel angle or RPM.

    FYI on my 2008 USDM Impreza WRX I have seen the following CAN IDs on the HS bus at the ODB port. this was in about a 2 minute drive around the block.

    0x2 2400 times
    0x60 1 times
    0x70 133 times
    0x75 176 times
    0x80 141 times
    0x410 618 times
    0x411 213 times
    0x412 186 times
    0x501 176 times
    0x511 142 times
    0x512 152 times
    0x513 141 times
    0x514 172 times
    0x576 817 times
    0x600 31 times
    0x601 3055 times
    0x620 932 times


  15. Hi chris ,
    you can detect easy also other engine parameters with Arduino…
    for example steering wheel angle normally it is defined with 2 bytes resolution (16 bits ) , but it is possible to have only 15 /14 / 13 / 12 / 11 / 10 etc … bits really used.
    in any case you can change the steering whhel in the following position o° 90° -90° 180° -180° etc …
    and you can read the value with Arduino , for example at 90° you read 0x168 that in decimal is 360
    360 / 4(X) = 90 and this the value in degree. obviously X must be calculated …
    for negative value it depend , in some case -1 is 0xFFFF or 0x8001 , where the first bit on the left indiacate the sign “-”
    for 1 and “+” for 0, in some other case the value is calculate with a negative offset , for example 0 is the value sent
    by ECU , -300 is the offset , so the finale value is -300 …

    Also for RPM , generally it is defined with 2 bytes (16 bits) and normally the value sent by ECU is the RPM value ,
    in some case the value must be divide with 4 , for example 1000 = 1000 rpm , 1000 / 4 = 250 rpm….

    you can put a LCD display to arduino platform and you can show the bytes releated to wheel speed (front and rear).
    that you drive at 90 kmh fixed and detect the raw value sent by abs module. so 0 is 0 kmh and for example 900 = 90.0 kmh ….

    more difficult it is to detect acceleration.
    or the exactly value of brake pressure without compare value with othe insruments…


  16. Hi everyone,

    I believe there are two CAN buses: a high speed one (all of the above on this page – I guess) and a low speed one (connecting BIU and combination meter). Has an anyone looked into the low speed CAN bus? Is there a connection between the two?

    I’m keen to talk to the combination meter to try and display extra information. E.g. I recently noticed that next to the mileage of the odometer there seems to be a single digit to display the current gear and up/downward pointing arrows above/below it. I assume those are used for STI’s or automatic gear boxes? I’d like to bring those to live on my MY’10 Diesel (for a shift indicator).



    • Yes, high (500 kbps) and low speed (125 kbps, not available on OBD socket). Only BIU is connected to both.
      In post Coolant Temperature I used (high speed bus via OBD port) CAN injection to simulate CAN frames from ECU. Worked well after telling ECU to stop sending its messages. I could also simulate fuel consumption and notice the effect on the center display.
      BIU translates or copies some of the data to low speed bus where combination meter picks it up.
      Don’t know about shift indicator stuff. Also possible that combination meter decides on its own.
      Did not sniff low speed bus on my own car, takes a bit of work to look up pinout and connect to the wire, though, I am certainly interested…
      Btw, on Euro 4 diesel at least, tachometer is driven by square wave signal directly from ECU, not CAN data. Similar to EcuTek patched ECUs I used this method for my own kernel experiments e.g. display error# via tachometer needle.


      • I hadn’t noticed the details in your coolant temperature post. I’m also still learning how CAN works exactly and only now started wondering what would happen if I would send additional messages myself. But I was hoping the extra fields in the combination meter could be triggered.

        From what I can tell the low speed bus connects BIU, A/C and Audio/Nav-unit. That’s where I found 2 pins connecting to the stereo which should be CAN hi/lo (assuming this is valid: Initially I thought this was an alternative point to (permanently) get CAN messages from the ECU etc. If and when I get hold of the connectors I’ll attach my CAN device there (though this will take quite a while).


      • Correct, you will find low speed bus on audio/satnav connector. On 2009/10/11 diesels apart from the usual suspects you mentioned there’s also a little “Gateway CM” attached to this bus but not important.
        Interesting to see what’s on this bus, wether specific CAN frames are copied by BIU or data is encoded into new frames between busses.
        Some info proved useful to me: canbushack: Hack Your Car


  17. Here are some more codes for when I lock my Subaru 2010 Outback 2.0D using the keyfob.

    Count & ID

    36 0x351
    38 0x352
    331 0x391
    671 0x431
    377 0x432
    407 0x491
    394 0x705
    475 0x706

    Sample of complete frames:
    Tell me where to send it and I will email the entire log.


  18. Awesome, I will do. I am currenty working on a tool using a STM32F103 to interface to this car, trying to wrap my head around the low level CAN interface. Can you please confirm if the ECU will respond to SID 0x07DF? And does the ignition need to be on for a response?


    • Subaru (diesel) ECUs usually respond to ID 0x7E0 but also functional ID 0x7DF. (Others like BMW need 0x7DF to get through gateway control unit).
      It is perfectly safe to try both IDs.
      Yes, IG on is required to power up ECU (and others) and receive responses, you will see much more traffic on the high speed bus.
      For longer diagnostic messages which do not fit into single CAN frame you’ll need to implement ISO TP protocol, relatively easy to code.
      And in case you don’t know this site yet:


      • Not sure how you’re going to run the Cortex chip, but I find socket-can quite handy. And I think I’ve managed to get ISO TP modules working. Not dared to do much with it, but at least most of the implementation is done already.


      • Nowerdays I also use SocketCAN whenever possible – it’s awesome, native Linux, lots of tools. Does ISO-TP and similar protocols like extended addressing (i.e. BMW DCAN) perfectly, saving a good chunk of application source code. Also, implementing multiframe protocols via app (send & receive CAN frames) often yields significantly less throughput for reflashing.


  19. I’m fairly certain byte 4 bit 2 of 0x501 is “ABS Active” – I’ve got some data in a Wireshark trace that, when plotted, shows byte 4 = 0x4 when ABS is active.

    Great timing – we got fresh snow in an empty park (e.g slippery conditions and the ability to floor it/slam on the brakes safely) the day after I got my CAN interface working. 🙂

    Torque limit (byte 2) always seems to be zero for me, but the “allowed torque” drops when byte 4 bit 0 is 1.


    • Hmm, I can’t edit comments, but I also observed that the brake pressure (byte 4 of 0x511) never seems to be greater than 0x20 for me. I am also seeing data in Byte 5 of 0x511 – it roughly seems to track the steering torque in sign and magnitude, but the maximum absolute value of this appears to be less than 0x10 – possibly less than decimal 10.


  20. Does anyone have any information on the IDs for the low-speed (125kbps) bus?
    Looking to drive a tach and speedo, but it seems to be more complex than just a single ID to get either working.


    • Don’t have these, sorry.
      As for tachometer, old models like Euro 4 diesels used extra line (square wave signal, frequency ↑ = RPM ↑) from ECU to dashboard. I tested this successfully by compiling and uploading own software taking full control, generating such signal. See tach photo on post Over-Rev.


  21. Over at we figured out some of the switches on the BIU. All the data above appeared to match what we had logged.

    Address: 0x514
    Byte: 0 {corrected post}
    Bit 6: downshift
    Bit 5: upshift
    Bit 4: sport mode


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s