370Z CAN Bus Proprietary PID's

GrayGhost

I have to check when i get home, but i believe it is an obd to usb based off the stn1110 chip through a raspberry pi using python


Sent from my iPhone using Tapatalk

dts3

I'm not familiar with the CAN solutions on the Pi. Does that just give you raw data? Can you load database files

GrayGhost

Im sure there may be a way to work with database files through python but i am not sure how. I can get raw data from the obd2 by sending requests over a serial port. From my understanding of this thread, it seems that it is possible to intercept the CAN data and record what the control systems are sending back and forth. This would allow me to get some of the more interesting data like tire pressures and yaw rate etc.


Sent from my iPhone using Tapatalk

GrayGhost

I just dont know how to intercept that CAN data


Sent from my iPhone using Tapatalk

dts3

I could be misunderstanding the tools that you're using, but I would assume that the raw data that you're reading over the serial->OBD connection you have is the raw CAN data.

I'm personally using a program called CANalyzer by Vector. It interfaces to a hardware module that plugs into my laptop's USB port and then into the OBD port. I added a screenshot that shows some of the CAN traffic, including the line for the tire pressure from address 0x385. I asked about CAN database files because we could more easily give meaning to the data (Instead of showing 0x385, maybe it would say something like "tpm_ecu") and it can give interpretations of all the bytes of the response message, along with any conversion or scaling

Attached Images

Capture.PNG (38.3 KB, 55 views)

dts3

I should probably add that my data doesn't line up completely with the spreadsheet. I have ids that he doesn't list, which I wouldn't think too much about. But he also has ids that I don't see over the course of a ten minute log

dts3

I just want to add a little info to this. Nothing truly helpful; just something I noticed. I have a manual base model (no rev matching) and I REALLY want to plot my current gear against other data.

I noticed that in all of my logs that I never receive any messages with id 0x421 (what's supposed to contain this data). Looking at the spreadsheet, I see that this message also transmits the S-Mode status. I remember a post I read a while back about adding rev matching to a base model, and two of the things needed are a gear position sensor and a new ECU. Given that I don't have the proper ECU (or even the actual sensor!), this has to be the reason that this message isn't on the bus. Just a heads-up to anyone with a base model trying to sniff out the CAN bus.

Knio

Yup, the base model does not have the gear position sensor. You could always do what my motorbike does and compute the ratio between the RPM and rear wheel speeds to look up the gear. Only works when moving and clutch engaged though.

jax4557

I am starting to use an app called "realdash" for a replacement gauge cluster in my Z and have been looking into the canbus as well. I have found most of what I need but I was wondering if anyone has been able to get the message for blinkers left/right, e brake warning, and door ajar? Also, has anyone been able to pop the trunk, roll windows up and down, or alter AC systems through canbus? Thinking about running a tablet in the center with the realdash software with a custom template made only for the above car control functions.




Thanks in advance,

__________________
BP Precision 6766 - E85 - 620hp / 550tq

Knio

The signals for blinkers, doors, and ebrake should be in the spreadsheet under the BCM.

Unfortunately I don’t think you can control anything over CAN because the input switches go directly into the BCM and not over CAN, but I could be wrong there

dts3

I just successfully locked/unlocked my doors over CAN based on the OP's posts and blog. This is basically repeating what he's already done. The following 3 CAN messages were sent to address 0x745:

02 10 c0 00 00 00 00 00
Enter the diagnostic session that allows us to issue service 0x30 requests (which allows commanding of the BCM)

02 3e 80 00 00 00 00 00
Tester Present. I'm sending it periodically every 2.5 seconds to keep the ECU from dropping out of the diagnostic session that I put it in.

04 30 05 00 01 00 00 00
The command to lock/unlock the doors. He's explained in the blog and in this thread what the parameters to this command mean, so I will not repost
all of that

Paul_S

Very nice. I've not seen that before.

You might find this project interesting:

https://www.youtube.com/watch?v=_13IPpjElL0

This guy used an Arduino to talk to the canbus and wrote his own Android app to talk to that and control the HVAC.

I'm looking to do something similar myself.

The HVAC won't work on the base model unless you swap out the control unit because the base model one doesn't have canbus control.

__________________

dts3

That looks interesting. I have access to Vector CAN tools so that's what I've been using. I'm currently making a database file (dbc) for the 370 that I'll share when I'm done.

I figured that would be the case regarding the HVAC after seeing things mentioned in the FSM.

jax4557

I don't mind swapping the module if needed to talk AC via canbus but not sure what the commands are for the AC. They don't seem to be in the system.

__________________
BP Precision 6766 - E85 - 620hp / 550tq

dts3

The signals are indeed in the spreadsheet. The first tab labeled "370 CAN" breaks the messages down as well. As for controlling devices on the bus... I believe that the OP said he was able to control things with some of the PIDs he listed after putting the ECUs into diagnostic mode. I don't remember if it was a forum post or on his blog. OP answered a question of mine not too long ago so he's still active here.