turbo2ltr
Well-known member
I am going to preface this with a disclaimer. I have been in the business of automotive datalogging for the past 10 years. My primary reason for spending every waking moment for the past few weeks working on this is so I can make products that will pay the bills. I'm going to share some information I have found simply to benefit the community. I will not be sharing the detailed findings of my reverse engineering efforts. I feel I'm in a unique position market-wise (having a car very early in the game) and with the economy the way it is, I really *need* to take full advantage. With that said, please don't get upset if I don't answer your questions.
I deal with CAN almost daily, but it was always on products that were engineered by us or at the very least, we knew exactly what we were looking at via full documentation.
I used a CAN to USB adapter for all work. It's a straight CAN adapter, not one that tries to connect to OBDII.
I knew in order to get anything done, I'd need a way to process data efficiently. At the speeds the data comes over the bus, you end up with incredible amounts of data very quickly. This lead me realize I need to develop my own program. This program allows me to monitor data, "watch" variables, "play" previously saved log files in real time (or faster/slower) to simulate driving, and send out my own modified messages very easily. It was quick and dirty so it's not pretty but it worked great.
My primary goal going in was to find a true SOC number. It seemed LEAF owners wanted this the most so I was intent on giving them that.
I found messages for:
Due to the nature of EVs, it is harder to differentiate between speed and motor RPM than ICE cars since they are coupled by single gear reduction box, so while I did find messages that appeared to be speed related, i did not pursue decoding the scaling of these parameters.
After initial excitement of finding the range/soc display controls, I quickly found out that the messages I found were just a way to control the dash. I was initially hoping the SOC would be sent to the dash and the dash would interpret the SOC into bargraphs. But no "computing" is done in the dash, the messages were strictly for controlling the dash.
So I continued my search and after a lot of searching and head scratching, I do believe I have found SOC.
Because there is no SOC numeric display to verify the findings, I had to do tests. The only feedback the car has is range and the SOC bargraphs. It was evident the bargraphs were not going to be useful for this (I'm not going to get into why). But if I send out my own message with a fake SOC value, the range on the dash changes. I needed to be sure that the number I thought was SOC wasn't really some range number. So I ran some tests.
I charged 100% last night which gave me 95 mile range. I plotted range vs what I suspected was SOC by sending out fake messages and observing the dash. I took note of where the battery low, battery very low and turtle mode were activated as well.
I then went for a 10 mile drive at 75-80 mph. My range went from 95 to 52 but I only lost two SOC bars, meaning the range adjusted for my forcasted driving style. I returned and plotted them again. By comparing the plots, one could see if the alleged SOC number was really SOC or was a range number that would have been corrected for driving style. You can see two distinct lines in the lot below. The lower one is the plot after I returned (I didn't plot nearly as many points).
I again checked what values the low battery, very low battery and turtle mode occurred and the values did not change, despite the range at which those events occurred changing.
Prior to the highway run:
Low batt: 16mi
Very low bat: 8
After Highway run
Low Batt: 13
Very low bat: 6
There is no range displayed when turtle mode is activated, but it was triggered at the same SOC number both before and after the trip.
According to my math, Low battery warning happens at 18%. Very low battery happens at 9%. Turtle mode happens at 2%. Some of you guys have done tests, how does this compare with what you came up with?
So with that said, I am confident this is the number we seek. Now on to step two...bringing it to the consumers..
I deal with CAN almost daily, but it was always on products that were engineered by us or at the very least, we knew exactly what we were looking at via full documentation.
I used a CAN to USB adapter for all work. It's a straight CAN adapter, not one that tries to connect to OBDII.
I knew in order to get anything done, I'd need a way to process data efficiently. At the speeds the data comes over the bus, you end up with incredible amounts of data very quickly. This lead me realize I need to develop my own program. This program allows me to monitor data, "watch" variables, "play" previously saved log files in real time (or faster/slower) to simulate driving, and send out my own modified messages very easily. It was quick and dirty so it's not pretty but it worked great.
My primary goal going in was to find a true SOC number. It seemed LEAF owners wanted this the most so I was intent on giving them that.
I found messages for:
- range
- the climate control +/- miles
- SOC and capacity Bargraphs
- All kinds of steering data such as steering angle, steering force and steering rate of change
- Numbers that look like torque readings
- per-wheel brake pressures
- all kinds of status type of data.. Switches, parking brake, PRNDL, want to know if the left turn signal bulb is on? no problem.
Due to the nature of EVs, it is harder to differentiate between speed and motor RPM than ICE cars since they are coupled by single gear reduction box, so while I did find messages that appeared to be speed related, i did not pursue decoding the scaling of these parameters.
After initial excitement of finding the range/soc display controls, I quickly found out that the messages I found were just a way to control the dash. I was initially hoping the SOC would be sent to the dash and the dash would interpret the SOC into bargraphs. But no "computing" is done in the dash, the messages were strictly for controlling the dash.
So I continued my search and after a lot of searching and head scratching, I do believe I have found SOC.
Because there is no SOC numeric display to verify the findings, I had to do tests. The only feedback the car has is range and the SOC bargraphs. It was evident the bargraphs were not going to be useful for this (I'm not going to get into why). But if I send out my own message with a fake SOC value, the range on the dash changes. I needed to be sure that the number I thought was SOC wasn't really some range number. So I ran some tests.
I charged 100% last night which gave me 95 mile range. I plotted range vs what I suspected was SOC by sending out fake messages and observing the dash. I took note of where the battery low, battery very low and turtle mode were activated as well.
I then went for a 10 mile drive at 75-80 mph. My range went from 95 to 52 but I only lost two SOC bars, meaning the range adjusted for my forcasted driving style. I returned and plotted them again. By comparing the plots, one could see if the alleged SOC number was really SOC or was a range number that would have been corrected for driving style. You can see two distinct lines in the lot below. The lower one is the plot after I returned (I didn't plot nearly as many points).
I again checked what values the low battery, very low battery and turtle mode occurred and the values did not change, despite the range at which those events occurred changing.
Prior to the highway run:
Low batt: 16mi
Very low bat: 8
After Highway run
Low Batt: 13
Very low bat: 6
There is no range displayed when turtle mode is activated, but it was triggered at the same SOC number both before and after the trip.
According to my math, Low battery warning happens at 18%. Very low battery happens at 9%. Turtle mode happens at 2%. Some of you guys have done tests, how does this compare with what you came up with?
So with that said, I am confident this is the number we seek. Now on to step two...bringing it to the consumers..