VQ35 - Nissan 350z

Discussions on CAN mapping for ECUs, sensors, PDMs, and more.
Post Reply
svanlare
Posts: 18
Joined: Mon Dec 24, 2018 1:26 am
Contact:

VQ35 - Nissan 350z

Post by svanlare »

We have a Lemons team with a 350z motor transplanted into a 300z body. As the vast majority of the wiring is now missing, the OBDII no longer works, but but ECU is still merrily outputting a couple of CANBUS messages. I've build a sniffer with an arduino and a CANBus hat which has worked pretty well to figure out what data is on the bus. Fortunately there are only 7 message types and I've been able to figure out the tach which is what I wanted for the next race. I'll keep updating here as I figure out more.

Sample of each message type I found
ID=505:LEN=2:04:00
ID=561:LEN=8:CE:10:00:CE:CE:CE:00:9E
ID=563:LEN=5:55:00:00:18:00
ID=573:LEN=8:53:00:00:00:00:F7:08:55
ID=574:LEN=8:00:00:00:00:00:00:00:00
ID=1361:LEN=7:4C:00:00:20:00:03:80
ID=1940:LEN=3:00:00:01
Last edited by svanlare on Thu Dec 27, 2018 8:07 pm, edited 1 time in total.

svanlare
Posts: 18
Joined: Mon Dec 24, 2018 1:26 am
Contact:

Post by svanlare »

TPS Signal

The 2nd byte (position 1) of message ID 573 was the easiest to figure out. With the car not running, and sitting in the drivers seat pressing on the throttle pedal, the values go from 00-FF.

There are a number of other values that change at the same time as the TPS.

The 3rd byte I think is a raw value of one of the two TPS sensors as it goes from 00-83
The 3rd byte of message 561 I think is the raw value of the other TPS sensor, it goes from 00-C8

I have no idea what these outputs are for but Bytes 1, 3 and 4 go from FC to FF, then 00 to 1C at about half throttle, then stay at 1C from half throttle till full throttle.

svanlare
Posts: 18
Joined: Mon Dec 24, 2018 1:26 am
Contact:

Post by svanlare »

Tach

To find the tach, I ended up plotting every changing byte while running the car first at idle, then trying to hold around 2K for a bit. Ended up with a 16 bit number little endian formatted.

The tach is on message 573 bytes 3 and 4. It is little endian formatted and needs to be multiplied by 3.[/b]

svanlare
Posts: 18
Joined: Mon Dec 24, 2018 1:26 am
Contact:

Post by svanlare »

Message 574

This one is always 0 for all the bytes. No idea what it should be, but from the ECU I'm just ignoring this one.

svanlare
Posts: 18
Joined: Mon Dec 24, 2018 1:26 am
Contact:

Post by svanlare »

Water Temp

Not sure yet if this is right. Next time I hang out with the car I'll do some more testing. I ran a long test letting the car come up to temp and logging what came out of the ECU. Byte 8 of message 573 seems to be the right kind of graph. Based on the 370Z I was expecting it to be offset from 0 for negative numbers.

water temp in C = 'message 573 Byte 8' - 48

svanlare
Posts: 18
Joined: Mon Dec 24, 2018 1:26 am
Contact:

Post by svanlare »

Don't know

Left in message 573 is Byte 1 and bytes 6 and 7.

6 and 7 look like a 2's comp 16 bit little endian number, but I cannot figure out what the sensor is measuring. Value is high when the car on but the motor isn't running (2300) then goes low when the car starts (150) then creeps up to a stable value at idle (500). Surges with throttle blips (to 2000) and falls on lift (sometimes going negative).

Byte 1 seems to be a packed binary value. Bits 6&7 just walk through 0,1,2,3,0,... changing once every 10 ms. So probably a reference count. Bits 0, 1, and 5 toggle occasionally, but not sure why

brentp
Site Admin
Posts: 6274
Joined: Wed Jan 24, 2007 6:36 am

Post by brentp »

Hi, thanks for documenting all of this and sharing your progress.

We recently published a blog post that talks about some reverse engineering work we did for a Mustang, which included an improved script for detecting changes in CAN data you can use to detect patterns in the data.
https://www.autosportlabs.com/reverse-e ... el-speeds/

Also, we already have a 370Z mapping under the CAN presets; I wonder if it's similar to what you're discovering?

In any case, when you complete your sleuthing, we'd be happy to add a 350Z preset as well, we'd just need your RaceCapture configuration file.

Thanks!
Brent Picasso
CEO and Founder, Autosport Labs
Facebook | Twitter

svanlare
Posts: 18
Joined: Mon Dec 24, 2018 1:26 am
Contact:

Post by svanlare »

Thanks for the reply, reading through the mustang write up now. I debugged what I have using a python script I found on GitHub and an Arduino with the CANBus shield that I coded to really just be a bus sniffer. It just showed the last message for a given CANBus id in a sorted list, so that while we changed things in the car, it was easy to see what bytes were changing on the CANBus. Moving all that code to race capture script to figure things out is a great idea.

svanlare
Posts: 18
Joined: Mon Dec 24, 2018 1:26 am
Contact:

Post by svanlare »

Water Temp

ok, positive I have the right byte, but not a 100% on the conversion. Going to try a race next week and see how it lines up with the gauge on the dash before we call it good.

I didn't figure out any other signals this weekend as I spent my whole time getting the system installed in the car and up and running.

russian2
Posts: 2
Joined: Fri Feb 05, 2021 5:19 pm

Re: VQ35 - Nissan 350z

Post by russian2 »

Thank you for publishing your finding, I am a bit shocked to learn how little is known about Nissan CAN messages. Let's see how much can I figure out about my VG40 :)

brentp
Site Admin
Posts: 6274
Joined: Wed Jan 24, 2007 6:36 am

Re: VQ35 - Nissan 350z

Post by brentp »

If someone attaches a working .rcp file we can add it as a system preset - and feature your car in the image. Let us know! :D
Brent Picasso
CEO and Founder, Autosport Labs
Facebook | Twitter

ervinjason
Posts: 1
Joined: Wed Jun 15, 2022 3:22 pm

Re: VQ35 - Nissan 350z

Post by ervinjason »

The 2nd byte (position 1) of message ID 573 was the easiest to figure out.

With the car not running, and sitting in the drivers seat pressing on the throttle pedal, the values go from 00-FF.

There are a number of other values that change at the same time as the TPS.

The 3rd byte I think is a raw value of one of the two TPS sensors as it goes from 00-83
The 3rd byte of message 561 I think is the raw value of the other TPS sensor, it goes from 00-C8

I have no idea what these outputs are for but Bytes 1, 3 and 4 go from FC to FF, then 00 to 1C at about half throttle, then stay at 1C from half throttle till full throttle.
Alight Motion is the first professional motion design app for Mac, bringing you professional-quality animation, motion graphics, visual effects, video editing, video compositing, and more!

brentp
Site Admin
Posts: 6274
Joined: Wed Jan 24, 2007 6:36 am

Re: VQ35 - Nissan 350z

Post by brentp »

Hi,

Thanks for the follow up. Did you manage to create a CAN mapping with some channels defined? If so, share your config here and we can help you out.
Brent Picasso
CEO and Founder, Autosport Labs
Facebook | Twitter

Post Reply