Reverse engineering dashboard Nissan Muran Z50

We have a 2005 Nissan Murano. American. Neither bluetooth nor, even more so, a digital dashboard, but I want to. If the problem with bluetooth is solved by screwing devices like this:

… Then it will be more difficult to digitize the dashboard. However, the eyes are afraid, but the hands do.

For experiments, I purchased a tidy from a European, but fundamentally it does not differ from an American in anything, except for the location of the odometer and brake light buttons, and the current settings for the speedometer needle (and it is also not so fat and does not try to find oil from me). The fact is that a European and an American have a different maximum speed on the speedometer, respectively, at 240 km / h on an American, a European will show approximately 210. Thus, the graphic overlay is not interchangeable:

Further, according to the documentation for the dashboard (the Pidorka.pdf file, I will leave all the archives at the end), connect the power to the tidy. Contacts 22, 23, 24 are black wires, in the diagram are marked with the letter “B” we connect to the minus (one or all together it does not matter), and contacts 21 “Y / R” are yellow with a red stripe and 20 “O” are orange (both at once ) to + 12 volts. Contact 15 “R / W” red with a white stripe is the lighting of the tidy, the same 12 volts, but it is not necessary to connect. Important note: the actual contact number may differ from the one indicated in the diagram, because nisan engineers are Japanese all over their heads and change the contact number in Japanese! That is, there are three plugs on the board – one main for connecting to a wheelbarrow and two for connecting the brake light and odometer reset buttons. So, instead of designating contacts from 1 to the maximum in each plug, they combined the numbers of all three plugs into one group, so the first contact by number is on the first plug, and the last one on the third. In short, be guided by the colors and my pictures. Here is a photo of the back:

Here is a diagram from the Pidorka.pdf file (page 10) with contact numbers and where it goes:

And now I will describe how the panel works according to the Pribka.pdf documentation.

  • Seat belt lamp track 3
  • Washer lamp – pin 6
  • Battery lamp pin 4
  • Alarm lamp pin 5
  • Speedometer operation:

Contact 14 “V / W” Purple with white stripe. The dashboard outputs +5 volts to it. The signal from the speed sensor closes the contact to ground, forming a logical unit on it. There are 8 pulses to the ground per wheel revolution.

And here the most delicious begins. All other data that the dashboard displays comes via the UART bus, namely: tachometer, fuel level, coolant temperature, engine error, CVT, ABS, low tire pressure, AWD, AWD Lock, turn signal, high beam, VDC OFF, SLIP, cruise control indicators – CRUISE and SET, CVT, open door indicator, oil level, dimensions, beeper signal and gearbox mode (P, D, R, S and so on including manual mode and gear number). Odometer mileage is calculated according to the speedometer signal readings and is written to the dashboard memory (including). When I connect someone else’s tidy to my car, the odometer readings of a non-native tidy are not reset.

Next, I will give the readings of the tidy when the power is connected, but there are no control signals (according to the file Tidy.pdf page 32). The UART is not connected and pin lines 3, 4, 5 and 6 are in the air:

Speedometer, tachometer, fuel, cooling temperature readings on zeros. The panel itself will be in night mode, that is, the instrument lighting is on. The variator display shows nothing. The squeaker is silent.

ABS, VDC OFF, SLIP, Brake Error – All of these indicators should be on when power is connected and there is no communication.

High beam, door not closed, low tire pressure, CRUISE, SET, AWD, AWD LOCK, oil, turn signals, engine error, CVT – these lamps will be off.

Now we need to connect to the UART pins and output data to the computer using a USB-UART bridge. I used this one:

You can use any other USB to UART bridge as requested. The stoned ones can get the percent from the arduino UNO or short-circuit it to a reset and use the built-in UART. In short, the TX of the device (pin 18 “R / L” red with a blue stripe) is connected to the RX of our UART converter and any of the black wires (pins 22, 23, 24) to the GND UART pin. Next, we launch any COM port monitor, select our UART in the list, connect and observe the stream of consciousness. This is the short version. Now in more detail. We download, for example, this is and plug the UART into USB. A new COM should appear in the COM Port list and connect to it. Now we are observing the stream of consciousness from the dashboard in the main window of the program. If we do not observe it, then you did everything right, since you still need to select the data reception speed – Baud Rate. Choosing different modes, I dismissed everything that is higher than 115200, because with such settings, the terminal produced solid zeros. At least some structure began to appear in the settings between 9600 and 19200. But it did not become clearer further. Disheartened, I propped my chin with my hand and, suddenly, I found an oscilloscope on the table! Wow – I thought. – I have such a thing! In short, I decided to see what this shaitan-machine will show. Having somehow picked up the settings, I observed an incomprehensible something with which, I don’t know what to do with my mind. Okay, let’s look for what Baud Rate actually stands for. Yeah, wikipedia says it is the number of data bits per second. Well, I think, let me look at the oscilloscope for the length of the shortest pulse. It turned out to be something like 70 nanoseconds. After scratching my turnip, I decided to divide this case into 1,000,000 nanoseconds, and why not? The result turned out to be close to 14400. There is such a speed – I thought again, and set the following settings just in case: Baud Rate 14400, Data bits – 8, Parity – odd, Stop bits – 1, Handshaking XON / XOFF. And damn it, it all suddenly worked! Well, that eats, nothing has changed, the window displayed the same strange set of characters, but the chuyka suggested that I was moving in the right direction. In short, I removed the following thing from the speedometer:

This is after decoding

A0 0F 00 0F 00 14 00 00 00 00 14 A1 0B 00 0B 00 6E 00 00 00 00 6E A2 0F 00 02 00 14 10 00 00 00 09 A3 07 00 00 00 6E 05 00 00 00 6C A4 0F 00 0C 40 34 3F 00 00 00 48 A5 02 00 0E 00 6E 01 08 00 00 6B A6 0C 00 01 00 14 1F 00 00 00 06 A7 00 00 0F 00 6E 00 00 00 00 61A8 00 00 00 00 14 00 00 00 00 14 A9 00 00 00 00 6E 00 00 00 00 6E 

I poked around with zeros, did not find anything interesting, but, suddenly again, I found that the byte with the sign “A …” is repeated every 10 times. I led to the following structure:

(Repeating piece)

A0 0F 00 0F 00 14 00 00 00 00 14 

A1 0B 00 0B 00 6E 00 00 00 00 6E 

A2 0F 00 02 00 14 10 00 00 00 09 

A3 07 00 00 00 6E 05 00 00 00 6C 

A4 0F 00 0C 40 34 3F 00 00 00 48 

A5 02 00 0E 00 6E 01 08 00 00 6B 

A6 0C 00 01 00 14 1F 00 00 00 06 

A7 00 00 0F 00 6E 00 00 00 00 61

A8 00 00 00 00 14 00 00 00 00 14 

A9 00 00 00 00 6E 00 00 00 00 6E

The penultimate two bytes are always the first zeros, if you translate HEX to DECIMAL, they grow from 160 to 169. HEX – the set of characters mentioned above is nothing more than decimal numbers in hexadecimal (I almost broke my fingers while writing) format.

It got hot. Let me think I’ll feed the same data to the tidy through Terminal. I plug the TX USB-UART converter into the RX of the device, and it starts beeping with all the colors of the rainbow. Here I guess it’s not so simple. Apparently the UART of the physical layer is somewhat different from that used in the same arduins. I remove the cover from the tidy, dull it on the board, redraw the circuit and yeah! Indeed, this is a differential pair. Without going into details, I will only say that I soldered directly to the pads that go directly to the controller and then everything worked fine. Here is a photo of where to solder something:

And now, the most delicious. We carry all this nanotechnology into the car, we cut our modified tidy, UART to the beech and tidy. And now we cut not the output to the tidy, but rather the INPUT (Contact 19 “R / B” red with a black stripe) to remove the data that the car sends to the dashboard. Then we turn on the ignition, launch Terminal on the beech and it starts recording everything that comes to the tidy. And now we start poking at all the buttons in a row in our car. We open and close the doors, turn on the wipers, press the gas-brake-reverse-see who has that, the distant light, the turn signals. It is advisable to kill the motor and variator so that we can remove the error codes of the motor and variator. Moreover, the motor must be killed in different versions and poses, and each sensor separately. In general, I took the data from the car, and this is what happened:

(Небольшой кусок от A0 до A9)

A0 40 00 00 78 3F 00 00 00 00 07 

A1 00 00 00 10 00 00 00 00 00 10 

A2 40 00 00 78 3F 00 00 00 00 07 

A3 00 00 00 10 00 00 00 00 00 10 

A4 40 00 00 78 3F 00 00 00 00 07 

A5 00 00 00 10 00 00 00 00 00 10 

A6 40 00 00 78 3F 00 00 00 00 07 

A7 00 00 00 10 00 00 00 00 00 10 

A8 40 00 00 78 3F 00 00 00 00 07 

A9 00 00 00 10 00 00 00 00 00 10 

Wow – I thought. – It’s almost like a speedometer! Let me, I think, feed the tidy up the logs that I recorded from the car. Fed. The tidy repeated everything that I got up to in a car from car to car. Eka I’m smart – I was not shy about myself! I decided to change some signs and feed the modified file to the tidy again. Nothing happened. Hmm – I thought. What to do then? And he was depressed, resting his chin on his hand again.

…. Strange numbers at the end of each section …
… Four pairs of zeros and then some numbers …
I opened the Windows calculator. For some reason I switched to HEX mode. For some reason, I decided to take all the numbers in the HEX format, excluding the section number and the last number, and multiply them together using the XOR method. Suddenly! The sum of the XOR numbers was equal to the last number in the section. Interesting – I thought. Apparently a bit of honesty crossed my mind. I changed several numbers, XOR them together, entered the amount at the end of the section and fed them to the tidy. The tidy changed the tachometer readings. All clear. The structure became clear:

A0 40 00 00 78 3F 00 00 00 00 07

Section number – A0

Data – 40 00 00 78 3F 00

End of Line Bits – 00 00 00

Parity bit – 07

In short, in order to decipher what where what bit changes to @ ovnokodil, I have this software:

Management is extremely primitive – click “Select port”. We are waiting … We are still waiting … We are waiting again … In any case, so it is with me. A window with a list of ports will pop up. By clicking on the port name, it connects to the port. L – Logic! To start the transfer, we poke the button “Start transfer”. L – Logic! The left side contains 10 sections from A0 to A9. During transmission, these sections are sequentially loaded into the selected port. Move the mouse pointer to any cell and turn the wheel. The values ​​change and the readings on the tidy change on the fly. On the right side, the answer from the tidy should have been displayed, but I’m @ the encoder, everything was stupid for me, because now there is just formatted output. You can save the current HEX settings to a file and then load it. To do this, press the buttons of the same name. The software automatically calculates the amount and recalculates the honesty byte. So we do not touch it, and you will not get nifiga. The byte in the blue square can be changed, but most likely it is a separator. It doesn’t seem to affect the data in any way. For a fully functional work, it is enough to feed the first two sections A0 and A1. The first section contains tachometer data and something else, in the second all the error bulbs and the position of the automatic transmission handle. In short, you will understand. In the middle, blue dots, these are the section sending switches. If it is blue, then this section is sent to the COM port. At startup, the default snap-in opens, which is 100% working. The softina curve flies out with enviable regularity, and I don’t care. IN archivist contains everything that is needed for independent dances from tambourines, including manuals for the car and my software curve.


Cloud servers from Macleod fast and safe.

Register using the link above or by clicking on the banner and get a 10% discount for the first month of renting a server of any configuration!

Similar Posts

Leave a Reply

Your email address will not be published. Required fields are marked *