contracts/docs/impl/reports/Z27AG-DECODE-1.md

type, date

type	date
report	2026-10-13

Z27AG CAN: first decoding pass

Session z27ag-20261013-170050-checklist (yukart-data can-captures/), checklist v1, 117 marks. Method: list every transition of every rarely-changing bit and read it against the marks; for blinking signals, count toggles inside each marked range against the seconds before it; for values, dump bytes across the marked range; for speed, correlate every 16-bit word with GNSS speed over the crawls. Marks lag the action by a fraction of a second to a few seconds (the operator presses after doing), so a change shortly before a start mark is normal.

Bit numbering: ID.byte.bit, byte 0 first, bit 7 the MSB.

Found

Signal	Where	Evidence	Confidence
Engine speed	210 bytes 4–5, BE, 1 rpm	idle 740–870; holds at ~1410 and ~1900 for "1500" / "2000" (operator: revs not exact); blip peak 2887	High
Engine speed, finer	13D bytes 0–1, LE, ≈ rpm × 2.048	moves in lockstep with 210	High
Accelerator pedal	210 byte 0, 0x00 released … 0xFA full (÷2.5 → %)	engine-off sweep: 0 → 0xFA → 0	High
Accelerator sensors 1 and 2	139 bytes 0 and 1 (raw, 0x33 rest … 0xEE full, track each other)	same sweep	High
Throttle-related	139 byte 2 (0x21 … 0xD5)	same sweep; plate or target	Medium
Pedal-pressed flag	210 byte 3 bit 7	set exactly while the pedal is off rest	Medium
Brake pedal switch	231.4.1 (1 = pressed)	3/3 presses, plus the foot-brake holds around the handbrake step and the crawls	High
Handbrake	239.0.2 (1 = applied)	set through every engaged stretch, clear during the crawls and the handbrake releases	High
Left indicator	423.2.6 blinking	2/2	High
Right indicator	423.2.5 blinking	2/2	High
Hazards	423.2.6 only blinks, 2/2	odd: 2.5 stays still. Maybe 2.6 is "left or hazard", maybe the hazard has its own bit elsewhere at a rate this method missed	Low
Side lights	423.2.2 and 570.7.3 (1 = on)	on/off and during dipped	High
Dipped beam	423.3.1 (1 = on)	1/1	Medium (one sample)
Any door open	423.2.1	driver and passenger	Medium
Driver door	423.0.4	driver only, not passenger	Medium
Driver belt unbuckled	573.5.7 (1 = unbuckled)	set at ignition on, cleared at buckle; no release seen	Low
A/C request / blower	443 bytes 1–2 and 711 bytes 5–6, multi-bit	change with A/C and blower; not separated yet	Low
A/C compressor engaged	13D.6.7	engine running, A/C on; set ~0.5 s after the request, cleared with A/C off	Medium
Four wheel speeds	235 four 16-bit words (bytes 0–1, 2–3, 4–5, 6–7)	zero parked, all four move together in the crawls	High (signal), scale open
Vehicle speed	231 byte 6 (and probably byte 7)	tracks the wheel words	Medium

Wheel-speed scale. Crawls topped out at ~6 km/h, and so far only the first byte of each word moved (0x4C at GNSS 3.5 km/h). Read as little-endian ×0.05 km/h (the forfour's 200 scale), that is 3.8 km/h, which is plausible given GNSS lag. Big-endian is not ruled out. The jack-stands session and a GNSS-matched drive settle both the byte order and the scale.

Not on this bus (or not seen)

• Clutch pedal: nothing changed in 3 presses, engine off.
• Gear position: nothing in 5 gears, reverse or neutral. Expected for a manual. The gear can be computed from rpm ÷ wheel speed once the scale is known.
• Reverse: no reverse bit found. The reverse lamp is probably wired directly.
• Steering angle: not analysed yet (step 5 was done with the engine on, at the end).

Not analysed yet

• 312 (four noisy 16-bit words that follow the throttle: MAP/load/air candidates)
• 449 temperatures (coolant candidate), 710–713 slow body/meter frames
• 0C0, 119, 149, 156 (counters/checksums; 149 inertial candidate)

Scripts

Scratch analysis for now: a session loader, a transition timeline, a blink counter and a GNSS correlator, in Python with numpy. They become a tool once a DBC exists to check against.