RegisterSearchFAQMemberlistUsergroupsLog in
Reply to topic Page 1 of 1
VQ35 - Nissan 350z
Author Message
Reply with quote
Post VQ35 - Nissan 350z 
We have a Lemons team with a 350z motor transplanted into a 300z body. As the vast majority of the wiring is now missing, the OBDII no longer works, but but ECU is still merrily outputting a couple of CANBUS messages. I've build a sniffer with an arduino and a CANBus hat which has worked pretty well to figure out what data is on the bus. Fortunately there are only 7 message types and I've been able to figure out the tach which is what I wanted for the next race. I'll keep updating here as I figure out more.

Sample of each message type I found
ID=505:LEN=2:04:00
ID=561:LEN=8:CE:10:00:CE:CE:CE:00:9E
ID=563:LEN=5:55:00:00:18:00
ID=573:LEN=8:53:00:00:00:00:F7:08:55
ID=574:LEN=8:00:00:00:00:00:00:00:00
ID=1361:LEN=7:4C:00:00:20:00:03:80
ID=1940:LEN=3:00:00:01



Last edited by svanlare on Thu Dec 27, 2018 8:07 pm; edited 1 time in total
View user's profile Send private message Visit poster's website
Reply with quote
Post  
TPS Signal

The 2nd byte (position 1) of message ID 573 was the easiest to figure out. With the car not running, and sitting in the drivers seat pressing on the throttle pedal, the values go from 00-FF.

There are a number of other values that change at the same time as the TPS.

The 3rd byte I think is a raw value of one of the two TPS sensors as it goes from 00-83
The 3rd byte of message 561 I think is the raw value of the other TPS sensor, it goes from 00-C8

I have no idea what these outputs are for but Bytes 1, 3 and 4 go from FC to FF, then 00 to 1C at about half throttle, then stay at 1C from half throttle till full throttle.

View user's profile Send private message Visit poster's website
Reply with quote
Post  
Tach

To find the tach, I ended up plotting every changing byte while running the car first at idle, then trying to hold around 2K for a bit. Ended up with a 16 bit number little endian formatted.

The tach is on message 573 bytes 3 and 4. It is little endian formatted and needs to be multiplied by 3.[/b]

View user's profile Send private message Visit poster's website
Reply with quote
Post  
Message 574

This one is always 0 for all the bytes. No idea what it should be, but from the ECU I'm just ignoring this one.

View user's profile Send private message Visit poster's website
Reply with quote
Post  
Water Temp

Not sure yet if this is right. Next time I hang out with the car I'll do some more testing. I ran a long test letting the car come up to temp and logging what came out of the ECU. Byte 8 of message 573 seems to be the right kind of graph. Based on the 370Z I was expecting it to be offset from 0 for negative numbers.

water temp in C = 'message 573 Byte 8' - 48

View user's profile Send private message Visit poster's website
Reply with quote
Post  
Don't know

Left in message 573 is Byte 1 and bytes 6 and 7.

6 and 7 look like a 2's comp 16 bit little endian number, but I cannot figure out what the sensor is measuring. Value is high when the car on but the motor isn't running (2300) then goes low when the car starts (150) then creeps up to a stable value at idle (500). Surges with throttle blips (to 2000) and falls on lift (sometimes going negative).

Byte 1 seems to be a packed binary value. Bits 6&7 just walk through 0,1,2,3,0,... changing once every 10 ms. So probably a reference count. Bits 0, 1, and 5 toggle occasionally, but not sure why

View user's profile Send private message Visit poster's website
Reply with quote
Post  
Hi, thanks for documenting all of this and sharing your progress.

We recently published a blog post that talks about some reverse engineering work we did for a Mustang, which included an improved script for detecting changes in CAN data you can use to detect patterns in the data.
https://www.autosportlabs.com/reverse-engineering-ford-mustang-2011-2014-can-bus-steering-angle-throttle-position-brake-pressure-and-wheel-speeds/

Also, we already have a 370Z mapping under the CAN presets; I wonder if it's similar to what you're discovering?

In any case, when you complete your sleuthing, we'd be happy to add a 350Z preset as well, we'd just need your RaceCapture configuration file.

Thanks!


_________________
Brent Picasso
Founder, Autosport Labs
Facebook | Twitter
View user's profile Send private message Send e-mail
Reply with quote
Post  
Thanks for the reply, reading through the mustang write up now. I debugged what I have using a python script I found on GitHub and an Arduino with the CANBus shield that I coded to really just be a bus sniffer. It just showed the last message for a given CANBus id in a sorted list, so that while we changed things in the car, it was easy to see what bytes were changing on the CANBus. Moving all that code to race capture script to figure things out is a great idea.

View user's profile Send private message Visit poster's website
Reply with quote
Post  
Water Temp

ok, positive I have the right byte, but not a 100% on the conversion. Going to try a race next week and see how it lines up with the gauge on the dash before we call it good.

I didn't figure out any other signals this weekend as I spent my whole time getting the system installed in the car and up and running.

View user's profile Send private message Visit poster's website
Display posts from previous:
Reply to topic Page 1 of 1
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum