---
type: report
date: 2026-10-13
---
# Z27AG CAN: first decoding pass

Session `z27ag-20261013-170050-checklist` (yukart-data `can-captures/`), checklist v1,
117 marks. Method: list every transition of every rarely-changing bit and read it
against the marks; for blinking signals, count toggles inside each marked range
against the seconds before it; for values, dump bytes across the marked range; for
speed, correlate every 16-bit word with GNSS speed over the crawls. Marks lag the
action by a fraction of a second to a few seconds (the operator presses after doing),
so a change shortly *before* a start mark is normal.

Bit numbering: `ID.byte.bit`, byte 0 first, bit 7 the MSB.

## Found

| Signal | Where | Evidence | Confidence |
|---|---|---|---|
| Engine speed | `210` bytes 4–5, BE, 1 rpm | idle 740–870; holds at ~1410 and ~1900 for "1500" / "2000" (operator: revs not exact); blip peak 2887 | High |
| Engine speed, finer | `13D` bytes 0–1, LE, ≈ rpm × 2.048 | moves in lockstep with `210` | High |
| Accelerator pedal | `210` byte 0, 0x00 released … 0xFA full (÷2.5 → %) | engine-off sweep: 0 → 0xFA → 0 | High |
| Accelerator sensors 1 and 2 | `139` bytes 0 and 1 (raw, 0x33 rest … 0xEE full, track each other) | same sweep | High |
| Throttle-related | `139` byte 2 (0x21 … 0xD5) | same sweep; plate or target | Medium |
| Pedal-pressed flag | `210` byte 3 bit 7 | set exactly while the pedal is off rest | Medium |
| Brake pedal switch | `231.4.1` (1 = pressed) | 3/3 presses, plus the foot-brake holds around the handbrake step and the crawls | High |
| Handbrake | `239.0.2` (1 = applied) | set through every engaged stretch, clear during the crawls and the handbrake releases | High |
| Left indicator | `423.2.6` blinking | 2/2 | High |
| Right indicator | `423.2.5` blinking | 2/2 | High |
| Hazards | `423.2.6` only blinks, 2/2 | odd: `2.5` stays still. Maybe `2.6` is "left or hazard", maybe the hazard has its own bit elsewhere at a rate this method missed | Low |
| Side lights | `423.2.2` and `570.7.3` (1 = on) | on/off and during dipped | High |
| Dipped beam | `423.3.1` (1 = on) | 1/1 | Medium (one sample) |
| Any door open | `423.2.1` | driver and passenger | Medium |
| Driver door | `423.0.4` | driver only, not passenger | Medium |
| Driver belt unbuckled | `573.5.7` (1 = unbuckled) | set at ignition on, cleared at buckle; no release seen | Low |
| A/C request / blower | `443` bytes 1–2 and `711` bytes 5–6, multi-bit | change with A/C and blower; not separated yet | Low |
| A/C compressor engaged | `13D.6.7` | engine running, A/C on; set ~0.5 s after the request, cleared with A/C off | Medium |
| Four wheel speeds | `235` four 16-bit words (bytes 0–1, 2–3, 4–5, 6–7) | zero parked, all four move together in the crawls | High (signal), **scale open** |
| Vehicle speed | `231` byte 6 (and probably byte 7) | tracks the wheel words | Medium |

**Wheel-speed scale.** Crawls topped out at ~6 km/h, and so far only the first byte of each word moved
(0x4C at GNSS 3.5 km/h). Read as little-endian ×0.05 km/h (the forfour's `200`
scale), that is 3.8 km/h, which is plausible given GNSS lag. Big-endian is not ruled out. The
jack-stands session and a GNSS-matched drive settle both the byte order and the scale.

## Not on this bus (or not seen)

- **Clutch pedal:** nothing changed in 3 presses, engine off.
- **Gear position:** nothing in 5 gears, reverse or neutral. Expected for a manual:
  nothing on the car consumes it. Not computed from rpm ÷ wheel speed either (owner's
  call, 2026-10-13): the clutch is invisible, so the ratio lies whenever it slips or is
  down, and the gear matters most at a standstill (no 3rd-gear launch), where the ratio
  says nothing. A *recommended* gear from speed and rpm is the useful form, if any.
- **Reverse:** rechecked against both reverse stretches (engine-off gear walk, engine-on
  back crawl) versus every other gear, neutral, the forward crawl and idle: no bit
  separates them (the one near-miss, `449.0.0`, is the low bit of a temperature). The
  reverse lamp is wired, not on this bus; a backup camera would take its trigger from
  the lamp circuit. The jack-stands run's reverse step is one more sample.
- **Steering angle:** not analysed yet (step 5 was done with the engine on, at the end).

## Not analysed yet

- `312` (four noisy 16-bit words that follow the throttle: MAP/load/air candidates)
- `449` temperatures (coolant candidate), `710`–`713` slow body/meter frames
- `0C0`, `119`, `149`, `156` (counters/checksums; `149` inertial candidate)

## Scripts

Scratch analysis for now: a session loader, a transition timeline, a blink counter and a
GNSS correlator, in Python with numpy. They become a tool once a DBC exists to check
against.