Any interest for a VSP-delete module?

[alex076]

I would be interested. Owner of two Leafs: 2018 SV, which is already nearly silent when moving forward at any speed, and 2023 SV+; which is annoying as can be with its forward sounding drone that is audible both inside and outside the car until you're moving about 30 MPH or faster.
Contact me: [email protected]

 

[macgeeknz]

A VSP-delete module can be a valuable addition to a vehicle's performance modification toolkit. By removing or bypassing the Vehicle Security Protocol (VSP) system, this module allows for enhanced customization and tuning of the vehicle's electronic systems. This modification can lead to improved performance metrics, such as increased horsepower and better throttle response, by eliminating factory-imposed restrictions. However, it's important to consider that VSP deletion can have implications for vehicle warranty and legal compliance, so it's advisable to ensure compatibility and consult with a professional before proceeding.

What a bunch of AI word-salad (BS). The Vehicle Safety for Pedestrians module has nothing to do with security or performance.

 

[dampkwab]

... the necessary periodic CAN frames that the combination meter is expecting...

I'd be interested to learn what those frames are as I've been thinking about trying to make a VSP replacement for my ZE1 with custom sounds. I have no experience with CAN hacking though, so I'm wondering where to start. Maybe I'll just grab a USB-CAN adapter and start sniffing...

 

[macgeeknz]

I'd be interested to learn what those frames are as I've been thinking about trying to make a VSP replacement for my ZE1 with custom sounds. I have no experience with CAN hacking though, so I'm wondering where to start. Maybe I'll just grab a USB-CAN adapter and start sniffing...

I'd be willing to work with you on this if you have the time, patience and inclination to do so. Here's some initial thoughts:

- I know the packets are periodic (1 hz?) and originate from the VSP and travel to the combination meter (combination meter is the Nissan service-manual name for the instrument cluster)

- disconnecting the VSP module from the wring loom causes a VSP error indicator to illuminate on the combination meter within 1-2 seconds

- reconnecting the VSP module to the wiring loom causes the error indicator to extinguish within 1-2 seconds

- messages are broadcast on the CAN bus, so when attaching to the bus it's not entirely obvious which messages originate specifically from the VSP

- the ZE1 has no less than 3 CAN busses, so care needs to be taken to connect directly to the same CAN bus as used by the VSP module

- one method of filtering packets to traffic known to originate from the VSP is to use a setup with dual CAN interfaces and build a CAN-CAN bridge between the interfaces then rewire the VSP to connect through the bridge (ie build a MiTM console)

- I believe SAVVY CAN can do this. It is also a most wonderful tool and in this scenario would be perfect for filtering different packet types and determining which bits and addresses are useful

I have an 8-devices Korlan USB2CAN and it works great, but I only have one of them.

 

[macgeeknz]

If the VSP Speaker signal + and - is an analog signal to the bumper speakers, could a voltage divider be added to the wire harness to reduce the output by some amount (20-50%)?

Yes, absolutely! See my last post for the location of the harness connector for the VSP - that would be a fine place to insert such a mod. Eg you could put a 10 ohm resistor in series with the wire on pin 8 (yellow) of connector m47. This won't quieten the in-cabin noises (originating from the combination meter) but it will reduce the external emissions

 

[macgeeknz]

What happens if 4ohm resistors are substituted for the speakers? External at least are not too hard to get to. I wonder where the interior speaker is, or does it use the audio system speakers? I'll get into the dash on my '22 soon.

Many of the internal noises are generated by the piezo inside the combination meter. It can be removed, but it's a medium-difficulty mod.

 

[Bombastinator2]

There’s a can can bridge?! There was this film once called “Moulin Rouge”….

"

 

[Lokaim]

Can you sample CAN bus messages with and without VSP attached, all other factors the same, and run a delta comparison diff against those two samples to identify the VSP messages?

If you can't recreate those messages,
Maybe wire a RasPi (or Arduino, etc) to draw from the VSP module's power and man in the middle the wires to the speaker to a relay to signal when to play audio as input to the microcontroller, connecting audio output to the speaker.

 

[BillAinCT]

Although they can tell by CAN communications that the VSP is there or not, they could also be measuring current to ensure the VSP is authentic and has the same load. This could be matched in a replacement device. It's just something to consider with this endeavor as to what extremes have they taken to ensure the Nissan VSP is installed. I bring this up because they measure the current of the shift sensor to know that it's present.

 

[dampkwab]

I dug into my Leaf today in search of the VSP's CAN frames.

First out were the driver's side vents, cluster surround & combination meter, behind which I found...

...nothing. Hmm OK, maybe my 2017 ZE1 is such an early specimen that they haven't moved the module from it's old ZE0 spot yet.
Luckily I had macgeeknz's Silencing the ZE1 thread & EV Enhanced's video of the process so that little misadventure didn't cost me too much time.

After putting that back together and pulling out the glove box I found what I was looking for:

There it is marked "C" in the top right. I piggybacked a few wires off the VSP's M47 connector to tap into the CAN bus:

Then it was just a matter of plugging a cheap CANable clone into my laptop, firing up Cangaroo, and looking for frames that disappear when the VSP is unplugged.

Before long I found 0x559 48 00 00 being sent at 100ms intervals whenever the VSP was present.
My Leaf also came stock with a VSP disable button on the dash (below the charge port open button) which, when pressed, illuminates the "VSP Off" light on the combination meter and changes that frame to 0x559 68 00 00.

That same warning light also comes on whenever the VSP is disconnected, so I sent 0x559 48 00 00 manually over the CAN bus and jackpot! The warning light immediately turned off.

I've got a microcontroller already synthesizing spaceship-y engine sounds, so I'll also set it to send that frame periodically and then figure out where best to pull my revving data from. The accelerator position wasn't too hard to find, but I haven't taken my laptop out for a drive to look for the speed yet.

Higher-res photos can be found here, including a couple of extra shots of the VSP PCB, which helpfully includes the full pinout on the silkscreen. It's a bit different from any of the wiring diagrams I've seen online - not sure if those differences are for the Japan market or if its just because I have such an early example of a ZE1.

 

[macgeeknz]

Excellent work @dampkwab and thanks for posting the magic number! I'm impressed that you discovered that without needing to do a MiTM CAN bridge - there is just so many packets going flat out all the time on the bus I didn't think you'd be able to narrow down the VSP one so easily

This really is begging for an open hardware PCB design accomodating a cheap micro (esp32?) & a CAN transceiver and a footprint for the same loom socket as used in the official VSP. Then it would be a plug-and-play swap out (maybe re-using the original VSP enclosure too).

I wonder if that socket is commercially available anywhere, or if harvesting the used ones is the only option. I realise the plug could be cut and a different type fitted given it's only a low number of conductors, but keeping the loom factory-original would be a nicer way to go about it (easy to return to the original VSP, eg may for a warrant of fitness check or whatever similar process in your countries).

For motor RPM (which correlates to speed), you can send UDS queries to the VCM via the OBD CAN. This is taken from the most excellent Leaf2018-CAN document (thank you, anonymous authors, whoever you are!

Name: RPM (r/min)
Type: Integer
Description: Motor revolutions per minute
Query: 0x797 03 22 12 55 00 00 00 00
Answer: 0x79A 05 62 12 55 FF AB 00 00
Formula:
RPM = ( data[4] << 8 ) | data[5];
if (RPM & 32768 == 32768):
RPM = RPM | -65536;

 

[Jerther]

Beware of feature creep. I'd be very happy with just a lower overall volume. Or just having it off entirely.

The sound dampening mats I stuck on the speakers are starting to peel off and now there's Krown anti rust stuff everywhere and nothing's sticking anymore. I'll be needing this project

 

[Bombastinator2]

I dug into my Leaf today in search of the VSP's CAN frames.

First out were the driver's side vents, cluster surround & combination meter, behind which I found...

...nothing. Hmm OK, maybe my 2017 ZE1 is such an early specimen that they haven't moved the module from it's old ZE0 spot yet.
Luckily I had macgeeknz's Silencing the ZE1 thread & EV Enhanced's video of the process so that little misadventure didn't cost me too much time.

After putting that back together and pulling out the glove box I found what I was looking for:

There it is marked "C" in the top right. I piggybacked a few wires off the VSP's M47 connector to tap into the CAN bus:

Then it was just a matter of plugging a cheap CANable clone into my laptop, firing up Cangaroo, and looking for frames that disappear when the VSP is unplugged.

Before long I found 0x559 48 00 00 being sent at 100ms intervals whenever the VSP was present.
My Leaf also came stock with a VSP disable button on the dash (below the charge port open button) which, when pressed, illuminates the "VSP Off" light on the combination meter and changes that frame to 0x559 68 00 00.

That same warning light also comes on whenever the VSP is disconnected, so I sent 0x559 48 00 00 manually over the CAN bus and jackpot! The warning light immediately turned off.

I've got a microcontroller already synthesizing spaceship-y engine sounds, so I'll also set it to send that frame periodically and then figure out where best to pull my revving data from. The accelerator position wasn't too hard to find, but I haven't taken my laptop out for a drive to look for the speed yet.

Higher-res photos can be found here, including a couple of extra shots of the VSP PCB, which helpfully includes the full pinout on the silkscreen. It's a bit different from any of the wiring diagrams I've seen online - not sure if those differences are for the Japan market or if its just because I have such an early example of a ZE1.

…but you could do, say, steam train chugga-chugga sounds or horse clopping sounds…

 

[dampkwab]

there is just so many packets going flat out all the time on the bus I didn't think you'd be able to narrow down the VSP one so easily

Me neither. I should also have mentioned Dala's CAN bus repo, which sped the search along by eliminating all the messages that the community has already identified. I'm hoping to get the speed without polling & there's a few good leads for that in the repo too.

Cangaroo made it pretty easy though - it groups received messages by ID and greys out any that haven't been received in a while. All I had to do in the end was unplug the VSP, look for the grey IDs (a few dozen or so), plug it back in and notice which one turned solid again.

I wonder if that socket is commercially available anywhere, or if harvesting the used ones is the only option.

The connector on the wiring harness is a Sumitomo TH16FW-NH (part no. 6098-5279), for which the male counterpart is the TH16MW-NH (6098-5281). They're readily available on Aliexpress but the samples I ordered a couple of weeks ago are still slowly making their way over from China.

Frustratingly, Sumitomo don't seem to produce the board-mount version of the socket & so far all my searches for that part have drawn a blank. Inspecting the VSP itself was probably my last hope but the socket is devoid of any useful identifying marks, so I think I'm just going to press on with the wire-mount version. If anyone figures out who manufactured that socket please let me know!

Beware of feature creep

…but you could do, say, steam train chugga-chugga sounds or horse clopping sounds…

I'm lucky enough to have a software-silenceable VSP, so this has always been about making silly noises for me. Steam engine noises are mighty tempting...

Feature creep is real though - I'm tempted to add a micro-SD slot to allow easy uploading of any prerecorded sound you want. I'm sure people would come up with some real doozies.

That said, the same module should work just as well for silencing newer Leafs so I'll be sure to post more details & code for anyone who wants to do the same once it's all working. I'll hopefully also end up with a spare module or two for other forum-goers if all goes well & if there's interest I might even look into doing a small production run.

 

[Bombastinator2]

Me neither. I should also have mentioned Dala's CAN bus repo, which sped the search along by eliminating all the messages that the community has already identified. I'm hoping to get the speed without polling & there's a few good leads for that in the repo too.

Cangaroo made it pretty easy though - it groups received messages by ID and greys out any that haven't been received in a while. All I had to do in the end was unplug the VSP, look for the grey IDs (a few dozen or so), plug it back in and notice which one turned solid again.


The connector on the wiring harness is a Sumitomo TH16FW-NH (part no. 6098-5279), for which the male counterpart is the TH16MW-NH (6098-5281). They're readily available on Aliexpress but the samples I ordered a couple of weeks ago are still slowly making their way over from China.

Frustratingly, Sumitomo don't seem to produce the board-mount version of the socket & so far all my searches for that part have drawn a blank. Inspecting the VSP itself was probably my last hope but the socket is devoid of any useful identifying marks, so I think I'm just going to press on with the wire-mount version. If anyone figures out who manufactured that socket please let me know!



I'm lucky enough to have a software-silenceable VSP, so this has always been about making silly noises for me. Steam engine noises are mighty tempting...

Feature creep is real though - I'm tempted to add a micro-SD slot to allow easy uploading of any prerecorded sound you want. I sure people would come up with some real doozies.

That said, the same module should work just as well for silencing newer Leafs so I'll be sure to post more details & code for anyone who wants to do the same once it's all working. I'll hopefully also end up with a spare module or two for other forum-goers if all goes well & if there's interest I might even look into doing a small production run.

<imagines ww2 backup sounds>
“come on boys! Re-TREAT!” “BACK IN THE WATER!”

 

[macgeeknz]

The connector on the wiring harness is a Sumitomo TH16FW-NH (part no. 6098-5279), for which the male counterpart is the TH16MW-NH (6098-5281). They're readily available on Aliexpress but the samples I ordered a couple of weeks ago are still slowly making their way over from China.

Excellent work once again on the sockets! It doesn't _have_ to be PCB mount - wired socket to the PCB would be fine - it would still allow swapping in the VSP-delete without needing to modify the loom, and it could still re-use the original housing if the PCB outline and mounting holes match the factory board

I think I will order a couple of those too and have a play. PCBs are so easily made these days it seems like it's only a matter of finding time to sit down and design the board layout.

Now what we need is someone with the newer model VSP (the one that can't be silenced through LeafSpy) to try these magic bytes with their combination meter...

 

[macgeeknz]

For those following this topic along, I just discovered this blog posting I hadn't seen before thanks to searching on the PCB code in @dampkwab's photos!

https://ianrees.nz/tech/2023-07-03-vsp-hacking.html

I wonder if he's already here in these forums...

 

[dampkwab]

it could still re-use the original housing if the PCB outline and mounting holes match the factory board

That would be tidy! At this point I'm just planning on leaving the stock module in place for ease of install/removal.

Now what we need is someone with the newer model VSP (the one that can't be silenced through LeafSpy) to try these magic bytes with their combination meter...

Anyone have a MY2020+ ZE1 they want to give it a go on?

 

[dampkwab]

I've recorded a few more CAN frames & thought I'd add them here in case they help anyone:

0x559 80 00 00 # Ignition off
0x559 48 00 00 # Ignition on
0x559 68 00 00 # Ignition on & VSP muted
0x559 48 40 00 # Driving (could indicate starting sound?)
0x559 48 C0 00 # Reversing

I also tried sending a few different frames of my own with the VSP unplugged and it seems like pretty well any message will be accepted & extinguish the warning lamp, as long as bit 5 is unset. For example, just sending 0x559 00 00 00 periodically is enough to keep the warning light off.

In other news I'm happy to report that my custom sounds are fully operational & I've tested it all out running on a breadboard in the car. All I'm waiting on now is for the connector to arrive so I can solder everything together & install it permanently!

 

[dampkwab]

I think I will order a couple of those too and have a play. PCBs are so easily made these days it seems like it's only a matter of finding time to sit down and design the board layout.

Hopefully you had more luck than me! The sockets I ordered still haven't shown up, so I suspect they've gotten lost somewhere along the way.

Luckily though, I did eventually find a compatible board-mount connector - TE part number 1318382-2 - which has better availability & even works well bodged onto a prototype that was intended to use the wire-mount