370z CAN Bus Data & Question?
 

I apologize in advance if there is a better location for this, I did look but didn't see a logical spot for "CAN Bus", so I posted it in general.

I have been doing a lot of research and reverse engineering my G37's CAN bus.
AND I would like to understand what is the same and what is different on the 370z's CAN bus.

However, I don't have access to a 370z to capture the CAN bus data (they are too quick for my G37!)

By chance, does anyone have or can get CAN bus data from their 370z?
There isn't any personal information in the data, no location and not even a VIN.

-OR- if you are in the Toronto area, if I buy you a coffee could I record it while you drive around the block?

The main reason for doing this is to make engine swaps easier and have working factory gauges. Something like a plug and play black box.

Thanks in advance!

There's a few people who have tried. Here's a couple of threads on the subject.

http://www.the370z.com/tuning/89695-...tary-pids.html
http://www.the370z.com/tuning/130942...s-hacking.html

Thanks for taking the time to find and post those links.
I feel like I have searched every inch of the internet for Nissan CAN bus logs and have been up and down those threads many times :)

Most people that want to reverse engineer CAN bus like to do so on an electric car, as they want to know more about the battery state of charge.

However, there is a lot of interesting data on our own CAN bus that could be useful.
For example, here is the raw data from the steering wheel position sensor:

http://www.the370z.com/attachment.ph...1&d=1626960088



The steering wheel data is updated 100 times per second, and it contains the steering wheel angle,
rate of steering wheel turning (degrees/sec) and some other stuff I haven't figured out.

Just hoping to wet someone's appetite :)

Hi,

I must have a CAN bus adapter somewhere and can get an ODB2 connector.

Care to share more details on how you are grabbing the logs and save me the googling part?

Sort of interested on this as well.

Subbed!

Absolutely!! That is what I LOVE to do... Learn and share :)

I designed, built and programmed a CAN bus to SD card recorder. It uses an $8 ESP32, a $2 CAN bus transceiver and a $2 SD card module.

I simply plug it into my car and go for a drive. It records all the CAN bus data to the SD card.

On a manual transmission G37, it records close to 1200 CAN bus messages per second and on an automatic G37 with AWD, that jumps up to 2200 CAN bus messages per second. (Thanks again Kevin & Andy!!)

Then I use SavvyCAN to visualize the data, reverse engineer it and build a "DBC" file that defines everything. (well not everything... some items are very difficult to figure out!)

The CAN bus data is saved in a "SavvyCan" format, so it makes it easy to open it in the FREE and EXCELLENT SavvyCAN program.

I am 90% done designing an easy to assemble kit that allow you to do this without any electronic or programming skills. I think everyone should be able to do this for under $50 an not spend $300+ for the commercial CAN to USB/SD kits.

Small update:
I now have full control of the G37 instrument panel/gauges using the CAN bus!
When I get 370z CAN bus logs, I will get it to work on the G37. If needed I can make up "translation gateway" to resolve any non-functional gauges.

Down the road, I should be able to get the 350/370 gauges to work with any other engine/ECU (VR, LS, HR to VQ, etc)

The 370 gauges are a little simplier to use, as they connect directly to the CAN bus. On the G35/G37 the "Unified Meter & A/C Amp" connects to the CAN bus and uses a serial connection to control the gauges.

Here is a before and after picture:
http://www.the370z.com/attachment.ph...1&d=1627051068

I will try to get you some logs over the weekend.

Do you have a github repo with all the work you have done?

Thank you for the getting the CAN logs for me!

No github yet, I have more reverse engineering to do and want to test/verify my assumptions.

I am very interested in this. I have a standalone ECU, MS3, and an LS swap on my car. I'm literally about to button up the engine in Aug. I'd LOVE to have all OE gauges work. If you have something to make my life easier for the CAN setup... My PayPal is ready to go.

https://sn3301files.storage.live.com...&cropmode=none

Mini Update:
This afternoon was fun...
By sending out CAN bus data, I can now fully control the instrument panel:
http://www.the370z.com/attachment.ph...1&d=1627074141

Tomorrow, I will re-verify today's work, just to make sure all is accurate.

What a nice project!!!
Later this evening, I will dig thought the MS3 documentation to understand their CAN bus system.

I don't think it will be too difficult... Once I know more, I'm sure I will have some questions.

I did a quick review of the MS3 documentation and it all looks good.

• Do you know what firmware version you have?
• What is missing/unplugged in the car?

I sent a message to you on Facebook.

Sent from my SM-G975U using Tapatalk

Since my last post, I have an additional 30+ hours reverse engineering the gauges. I really don't know what is wrong with me, but I LOVE this type of work!!


On the CAN bus I have found:
Paddle shifters (up & down), outside temp, all of the LCD images (middle of the G37 gauges), all of the warning lights, driver & passenger seat belt buckle status,
and two very interesting ones:

• Amount of fuel consumed since engine start
• Raw data of the fuel level float. I had no idea how much those float arms move!!

To give you an idea of the scope of the task here is some simple math:
Each ID the gauges receive typically have a payload of 8 data bytes.
That 8 bytes can be 8 values for an analog sensor, or 64 bits used for switch (lights on) or system status (engine off, engine running)
-OR- any mix of the above.

Now that was for a single CAN ID, most modules receive data from multiple IDs and the only way to find out, is to send specific data to a specific ID and see what happens.

In the next few days I will have some CAN logs from a 370z and will feed it to my G37 gauges. I am 99% certain everything will work as I would think the encoding is the same.

By the way, while sending speedometer data to the gauge cluster to figure out the "fuel consumed" my odometer went up just over 320 KM / 199 miles while on my desk!

Very nice! Thanks.

That's very cool!

Just having a little fun & re-verifying the CAN bus commands:
(I do have some 370z logs on their way to me and I expect them to me mostly the same and should work with both gauge clusters.
I will give an update after the analysis is done)

you can record my can bus if you want.

also this guy has some stuff on his blog
https://projectbytes.wordpress.com/2...z-can-hacking/
https://www.dropbox.com/s/cfpzb2mpj4...0CAN.xlsx?dl=0
also this
https://github.com/rampage128/niscan

https://github.com/rampage128/cardro...ontroller.java
maybe this can help too

Thanks for the links... I think I have already read them, but I will double check.

I will send you a PM about logging CAN bus data.
Thanks for the offer!!

Small update:
Thanks to a tuning shop in Poland, I have some 370z logs -AND- when I played them back on my G37 gauges, everything worked as expected!!

There are more 370z logs on their way to me and I will verify them against my G37 logs.

All of this will allow different engine swaps to have functioning stock gauges
and it will also allow the required ECU data to be translated and sent to different transmission control module, like the wonderful ZF 8HP for proper integration and function.

When I have looked at the other CAN logs, I will update the thread here.
If there is enough interest, I could put together and episode or two on how to get started with Nissan/Infiniti's (or any) CAN bus.

Bump for this. :tup:

I am so damn excited about this!

Any updates?

Kinda hoping to get something going to replace the left dot gauges with more useful info, especially having TPMS, temp, time, MPG, etc all in one little screen.

YES!

Unfortunately, I created multiple threads so the updates are in a few places.
Here is my attempt to get everything into one thread:
http://www.the370z.com/engine-drivet...-16-pages.html

TL;DR
https://youtu.be/lndZiRxDNOo

I know you offered this a while ago and there is a lot going in in the world right now, but if you could record your CAN bus for me, I would really appreciate it.

If possible:
• Connect CAN device and start to record
• Start up car and go for a 3-4 minute drive and use cruise control for 1 minute or so.
• Turn off car and wait 3 minutes before stopping the CAN bus recording.


Thanks in advance!

I was just about to set off down this route myself until I spotted this thread :D

Have you been able to interact with/set the cruise or speed limiter?

I believe, but I'm not sure, that the airbag system can be triggered by an errant CAN message (unconfirmed) - if you're injecting signals onto a live car, how are you ensuring this doesn't happen and do you know what they are? Would be a right pain to write off your car with a mis-sent message.

I found few ways to do complete scan and ways to send raw commands with the elm Bluetooth devices

If anyone knows the command that can be sent to clear the low tire light. Let me know please. I have already been able to do the basic, like honk the horn and headlights. Even the wippers.

I can display the current cruise set speed as it is broadcast on the CAN bus.
As for the speed limiter, that is coded into the ECU and would need to be found/reprogrammed to change it.

Most of the time, I am just receiving the CAN bus message and displaying it... no chance of anything bad happening.

The messages I do send on the CAN bus are the same ones that are already on the CAN bus, so I'm not adding anything new... no chance of anything bad happening.

As for airbag deployment, the airbag module uses multiple inputs from the CAN bus (like forward/reverse, gear, speed, etc) and the crash sensors to determine air bag deployment.

Overall, I don't think there is any chance of air bag deployment via CAN bus.

Since you are using an ELM327, you must be using UDS (unified diagnostic services) commands... good work! Did you reverse engineer them from a scan tool, or use that UDS spreadsheet that is floating around?

There is a CAN bus message that turns on/off the TPMS light and this is sent by the BCM depending on the TPMS status.

You might think that all we need to do is to send the command to turn off the TPMS light, but that won't work.

Here is why:
The BCM is also sending the command to have the light turn on 10 times per second.

Unfortunately, the result is an unpredictable / flickering TPMS light.
We can't have 2 devices sending opposing commands.

Turning off the TPMS light is something we have been working on for the last year and will be testing 2 different solutions on my G37 this fall.

One is an RF solution (simulates TPMS data) and the other is via the OBD port.
I'm sure many people would like to turn that TPMS light off... I know I want to!

TPMS light feels like it's more easily solved with an old school mechanical solution.

Just chuck the sensors into an air tight container with a schrader valve. Then pressurize the canister and stick it in the glovebox.

I unplugged the module on top of the glove box and drained the caps by shorting wile unpluged. I dont get the flashing main tpms anymore. Just the little light stays on. Only getting this because new rear tires inatall they switched the rims. I got the commands from reversing a android app. Thats a addon for Torque. First had to patch the app, it charges for each command. Its Remote EX for nissan. Also im having the dreded theottel body wine noise. And its even worse with a 1000k amp on my stereo highs. It goes aways as soon as i unplug the pasenger side throttel body. Im gona look into the fsm today and trace down the ground for them and add a ground loop icolator and see if it helps.

Sent from my GM1917 using Tapatalk

I'm not sure that works on Nissan TPMS sensors.
To maximize battery life, they only broadcast the tire pressure when in circular motion.

They ground through the ECM. In my engine stand I get TB noise when the throttles are powered. My car is the same however this noise stays in the bay and doesnt transfer over to audio.

I beleve its always been in the radio. Its just that I'm amplifying it. I didn't have it before i upgraded. And it does go away when the TB's are unpluged.

Sent from my GM1917 using Tapatalk

You will still get that noise in the engine bay created by the throttles as they turn on. The radio muffles it/ silences it.

The noise in the bay is different from the radio. You can confirm the noise if youre able to open your throttles with the vehicle off. It should be a high freq hum changing with throttle angle.