VQ35 - Nissan 350z

[svanlare]

We have a Lemons team with a 350z motor transplanted into a 300z body. As the vast majority of the wiring is now missing, the OBDII no longer works, but but ECU is still merrily outputting a couple of CANBUS messages. I've build a sniffer with an arduino and a CANBus hat which has worked pretty well to figure out what data is on the bus. Fortunately there are only 7 message types and I've been able to figure out the tach which is what I wanted for the next race. I'll keep updating here as I figure out more.

Sample of each message type I found
ID=505:LEN=2:04:00
ID=561:LEN=8:CE:10:00:CE:CE:CE:00:9E
ID=563:LEN=5:55:00:00:18:00
ID=573:LEN=8:53:00:00:00:00:F7:08:55
ID=574:LEN=8:00:00:00:00:00:00:00:00
ID=1361:LEN=7:4C:00:00:20:00:03:80
ID=1940:LEN=3:00:00:01

[svanlare]

TPS Signal

The 2nd byte (position 1) of message ID 573 was the easiest to figure out. With the car not running, and sitting in the drivers seat pressing on the throttle pedal, the values go from 00-FF.

There are a number of other values that change at the same time as the TPS.

The 3rd byte I think is a raw value of one of the two TPS sensors as it goes from 00-83
The 3rd byte of message 561 I think is the raw value of the other TPS sensor, it goes from 00-C8

I have no idea what these outputs are for but Bytes 1, 3 and 4 go from FC to FF, then 00 to 1C at about half throttle, then stay at 1C from half throttle till full throttle.

[svanlare]

Tach

To find the tach, I ended up plotting every changing byte while running the car first at idle, then trying to hold around 2K for a bit. Ended up with a 16 bit number little endian formatted.

The tach is on message 573 bytes 3 and 4. It is little endian formatted and needs to be multiplied by 3.[/b]

[svanlare]

Message 574

This one is always 0 for all the bytes. No idea what it should be, but from the ECU I'm just ignoring this one.

[svanlare]

Water Temp

Not sure yet if this is right. Next time I hang out with the car I'll do some more testing. I ran a long test letting the car come up to temp and logging what came out of the ECU. Byte 8 of message 573 seems to be the right kind of graph. Based on the 370Z I was expecting it to be offset from 0 for negative numbers.

water temp in C = 'message 573 Byte 8' - 48

[svanlare]

Don't know

Left in message 573 is Byte 1 and bytes 6 and 7.

6 and 7 look like a 2's comp 16 bit little endian number, but I cannot figure out what the sensor is measuring. Value is high when the car on but the motor isn't running (2300) then goes low when the car starts (150) then creeps up to a stable value at idle (500). Surges with throttle blips (to 2000) and falls on lift (sometimes going negative).

Byte 1 seems to be a packed binary value. Bits 6&7 just walk through 0,1,2,3,0,... changing once every 10 ms. So probably a reference count. Bits 0, 1, and 5 toggle occasionally, but not sure why

[brentp]

Hi, thanks for documenting all of this and sharing your progress.

We recently published a blog post that talks about some reverse engineering work we did for a Mustang, which included an improved script for detecting changes in CAN data you can use to detect patterns in the data.
https://www.autosportlabs.com/reverse-e ... el-speeds/

Also, we already have a 370Z mapping under the CAN presets; I wonder if it's similar to what you're discovering?

In any case, when you complete your sleuthing, we'd be happy to add a 350Z preset as well, we'd just need your RaceCapture configuration file.

Thanks!

[svanlare]

Thanks for the reply, reading through the mustang write up now. I debugged what I have using a python script I found on GitHub and an Arduino with the CANBus shield that I coded to really just be a bus sniffer. It just showed the last message for a given CANBus id in a sorted list, so that while we changed things in the car, it was easy to see what bytes were changing on the CANBus. Moving all that code to race capture script to figure things out is a great idea.

[svanlare]

Water Temp

ok, positive I have the right byte, but not a 100% on the conversion. Going to try a race next week and see how it lines up with the gauge on the dash before we call it good.

I didn't figure out any other signals this weekend as I spent my whole time getting the system installed in the car and up and running.

[russian2]

Thank you for publishing your finding, I am a bit shocked to learn how little is known about Nissan CAN messages. Let's see how much can I figure out about my VG40

[brentp]

If someone attaches a working .rcp file we can add it as a system preset - and feature your car in the image. Let us know!

[ervinjason]

The 2nd byte (position 1) of message ID 573 was the easiest to figure out.

With the car not running, and sitting in the drivers seat pressing on the throttle pedal, the values go from 00-FF.

There are a number of other values that change at the same time as the TPS.

The 3rd byte I think is a raw value of one of the two TPS sensors as it goes from 00-83
The 3rd byte of message 561 I think is the raw value of the other TPS sensor, it goes from 00-C8

I have no idea what these outputs are for but Bytes 1, 3 and 4 go from FC to FF, then 00 to 1C at about half throttle, then stay at 1C from half throttle till full throttle.

[brentp]

Hi,

Thanks for the follow up. Did you manage to create a CAN mapping with some channels defined? If so, share your config here and we can help you out.