Z27AG prior art: forfour 454 sibling, AiM Colt DBC, automated decoding

The forfour 454 notes (SmartCruiseControl) share our body and chassis
frames; the AiM "Colt" DBC is the EU Colt/forfour engine-side set and does
not match the Z27.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DDwfd6Ki8UfG4hK6W5YpJz

docs/impl/reports/Z27AG-CAN-PRIOR-ART.md

@@ -1,6 +1,7 @@
 ---
 type: report
 date: 2026-10-09
+updated: 2026-10-13
 ---
 # Z27AG CAN: prior art and a first look
 
@@ -13,6 +14,9 @@ already published.
 - **Nothing public decodes the Z27 Colt's broadcast frames.** No DBC, no ID list,
   for the Colt, Colt Ralliart, CZT or Version-R. The broadcast IDs have to be
   reverse-engineered against our own recordings.
+- **The smart forfour 454 is the useful sibling.** A sniffed 2006 forfour diesel
+  shares our body/chassis frames (`0C0`, `119`, `312`, …) but not the engine ones;
+  its notes are the first hypothesis for every shared ID.
 - **Diagnostic requests are well covered.** Mitsubishi's MUT-III protocol is
   KWP2000 over ISO 15765 (`0x21 <local id>` "mode 21" requests), and OBDb publishes
   open, machine-readable definitions for many Mitsubishi ECUs. Those are the fast
@@ -30,10 +34,18 @@ already published.
 | [ECUMASTER ADU application note, Evo X](https://www.ecumaster.cz/download/evoX.pdf) | Evo X OBD port at 500 kbps, pins 6/14, no terminator; a channel list (rpm, speed, tps, clt, wheel speeds, indicators, lights, gear) but the IDs only inside their `.canx` file | Same bus conventions as ours; no IDs |
 | [EvolutionM "Evo X real CAN packets"](https://www.evolutionm.net/forums/evo-x-engine-management-tuning-forums/552550-evo-x-real-can-packets.html) (forum, blocks automated fetch) | Evo X: RPM in `0x308` bytes 1–2; throttle in `0x210` bytes 0–1 | `0x210` exists on our bus too, but with a **different layout** (6 bytes; the RPM-like value is in bytes 4–5). Evo X IDs do not transfer |
 | [awesome-automotive-can-id](https://github.com/iDoka/awesome-automotive-can-id) | Index of public CAN ID collections; Mitsubishi: Lancer 2008 ([habr, RU](https://habr.com/ru/post/448658/)), i-MiEV | Lancer article covers diagnostics, not broadcast (below) |
+| [billyjack2/CAN-DBC-Collection](https://github.com/billyjack2/CAN-DBC-Collection) `MITSUBISHI/COLT/can1v3.dbc` | AiM logger driver "Mitsubishi Colt" as a DBC: wheel speeds `200`/`208`, pedal `210` byte 2, brake switch `300`, rpm `308`, speed and fuel `412`, battery `416`, coolant `608` | The EU Colt / forfour engine-side set (it matches the forfour notes below), **not the Z27's**: of its IDs only `210` and `300` exist here, and neither fits — `210` byte 2 stays `08` through a throttle blip while bytes 4–5 follow rpm; `300` is 4 bytes, not 8 |
+| [I2000C/SmartCruiseControl](https://github.com/I2000C/SmartCruiseControl) `doc/CAN bus reverse engineering.md` (MIT) | Smart forfour 454, 2006, **1.5 CDI diesel**, sniffed: ~30 IDs with lengths and byte notes. Decoded: `09E` odometer (bytes 4–6, 0.1 km), `200` handbrake + three speeds (×0.05 km/h, big-endian), `208` brake intensity + speeds, `210` pedal (byte 2), `212` pedal sensor 2, `308` rpm (bytes 1–2), `408` fuel litres, `40C`/`412` dash speed, `416` battery (0.1 V), `423` ignition / lights / indicators / doors bitfield, `608` coolant (−40) and fuel rate | **The closest relative found.** Body and chassis frames match ours: `0C0` (5 bytes, byte 3 always `07`, byte 4 counter; ours `6DFF0007xx`), `119` (byte 5 `08`), `312` (four 16-bit words), and `2F1`, `300`, `443`, `423` exist on both. The engine-side frames do not (`308`, `608`, `200`/`208` absent here; `210`, `423` other lengths and layouts) — plausibly because that car's engine ECU is Mercedes' diesel one and ours is Mitsubishi's 4G15T |
 
-The Z27 Colt is a 2002 platform shared with the smart forfour (W454). If any
-broadcast matrix carries over it is more likely from that side than from the Evo
-X — a direction to look in, not a finding. No forfour ID list turned up either.
+The Z27 Colt is a 2002 platform shared with the smart forfour (W454); the CZT /
+Ralliart's 4G15T is also the forfour Brabus engine, and parts listings show the
+sharing reaches the electrics (Z30 engine ECUs carry Mercedes-style `A135…` part
+numbers; the steering rack is the 454's). The forfour notes bear that out for the
+body bus. Their layouts are the first hypothesis for every shared ID, and their
+engine-side IDs a hint of what a petrol forfour or EU Colt would add. A forfour
+1.5 Brabus or a CZT capture would be the true sibling; none is public. The smart
+fortwo 451 ([hackaday.io](https://hackaday.io/project/19931-smart-fortwo-can-bus-reverse-engineering))
+shares `423` as the cluster status frame, little else.
 
 ### Diagnostic requests
 
@@ -69,6 +81,19 @@ below is a candidate until checked against OBD-II mode 01 in the same recording.
 Counters and checksums matter only for transmitting, which is out of scope. The
 decoder ignores those bits.
 
+## Automated decoding, in the literature
+
+Published tools do what the capture checklist sets up: record known values next to
+the raw frames and search the frames for them.
+[LibreCAN](https://rtcl.eecs.umich.edu/rtclweb/assets/publications/2019/fv075-peseA.pdf)
+fits OBD-II replies for powertrain signals and phone sensors for body ones (GNSS
+plays that part here); [CAN-D](https://www.ornl.gov/publication/can-d-modular-four-step-pipeline-comprehensively-decoding-controller-area-network-data)
+and [ByCAN](https://arxiv.org/html/2408.09265v1) find signal boundaries from bit
+flip rates, then byte order and signedness, then match. None reads our logs; the
+method — classify bits (counter, constant, live), cut signals, try both
+endiannesses, fit against OBD values at matching timestamps, rank — is the
+analysis tool to write.
+
 ## What would move Phase 2 fastest
 
 1. **Record mode 01 alongside the broadcast.** One `obd-poller` session polling