Thread: Nissan HVAC LAN --and test equipment for sniffing unknown bus

I think this falls under the "etc." portion of this subforum's title:

I have a project that requires a PC to be able to control the mode, recirc, and blend doors in an automotive HVAC system. This is a pretty straight forward process with an IO board like the fusion brain when the doors are driven by motors with variable analog signals, vacuum actuators, or servos driven by different voltages sent from the controller to open, close, hold the door based off of potentiometer feedback. I have changed the vehicle I'm first building this on, and I have run into a snag. The 3 servos that drive the doors in question are controlled locally. These 3 local control units drive the doors in relation to data sent on a common 1 wire bus.



They respond to addressed packets of data (if the address matches theirs). This bus is local, and not tied to the DTC via CAN or any other "reserved for mfr." position. This HVAC LAN is something I will have to tie into at the connector. I hope to connect in a manner such that I may first monitor, or sniff the message traffic so that I may decipher the protocol enoughto be able to replicate the messages sent from the OEM controller.

So I'm looking for a solution that will allow me to read the bus and subsequently update values in the software. And as the software begins to take a controlling role, the solution should probably provide a means to isolate the OEM controller during periods of computer control.





The voltage level at the bus is indicated to be 5.5Vdc in the service manual.
I'm at a loss for what kind of hardware to use (and accordingly, software - for sniffing). Have you worked with this small network before? Any insights into what steps to take? I've heard a rumor that the way addressing is implemented isn't actually by a block of bits after the start block, but in the frequency of the signal sent. I hope that's not true, because I'd be even more clueless as to how to tackle that.

So to make for some specific questions:

How do you attack a completely unknown data bus, when only a basic outline of the protocol is known?
- How do you determine the data rate? (trial and error?)
- Is hyperterminal the standard tool of choice for initial sniffing?
- I'm thinking it's not going to be as easy as hooking in to the Rx on a serial port, what hardware would I need in-between?
- Would it be more inportant to crack the HVAC controller open, and try to find out what chip is sending this signal directly?

What kind of switches are best suited for substituting the PC in place of the HVAC controller temporarily, on this 1 wire bus?