GregH
Posts: 860
Joined: Fri Jul 01, 2011 4:16 pm
Delivery Date: 13 Jun 2011
Leaf Number: 26967
Location: Irvine, CA

Re: Active EV-CAN sampling: cell voltages, pack temperatures

Sun May 04, 2014 1:02 pm

I would have expected about 40 ohms..
'17 blue Volt Premier w/ACC
'12 SL black Leaf
'11 SL blue Leaf
RAV4-EV 2002-2005
Gen1 & Gen2 EV1 1997-2003
PV 2.4Kw, 10kWh lithium battery SCE TOU-DA

nmgeek
Posts: 2
Joined: Fri Sep 11, 2015 8:18 am
Delivery Date: 11 Sep 2015

Re: Active EV-CAN sampling: cell voltages, pack temperatures...

Fri Sep 11, 2015 8:29 am

Is there a reasonably comprehensive list of the CAN 'active' query codes? I'm talking about the parameters for request codes like 797 and 745. I read through the google docs spreadsheet of CAN codes and have gotten through half of the 44 (ouch!) pages of the main CAN bus topic in the forum and have found only a dribbling of these codes (about 7 so far). I'm not sure of the exact terminology for these: polling codes, request/response codes, PIDs (Parameter IDs). So not knowing the official terminology I'm not sure exactly what to search for.

Glyndwr1998
Posts: 27
Joined: Mon Nov 23, 2015 4:50 pm
Delivery Date: 23 Nov 2016
Location: UK, South Wales

Re: Active EV-CAN sampling: cell voltages, pack temperatures

Fri Nov 27, 2015 3:49 am

Hi ticktock,

I am planning on using a complete leaf pack in a home energy recovery system, still utilising the original bms etc... I am looking at a microcontroller to extract cell voltages, pack voltage and temps exactly as you have done with your code and visual display. I intend to use leafspy as a display but I need a controller and code to switch off the charger and discharge relays to protect the battery, all this can be done utilising the eh outputs from a microcontroller and utilising your code.

Could you please specify what type of controller you used to talk to the bms and extract all the data, plus could you share the code with me please.
I'm not good at programming but I'm sure I could with a few extra lines of code to switch on and off n output to end charge / discharge of cells are high, low or hot.

Many thanks, and I lave the way this thread is helping others.

Best regards, Anthony.

TickTock wrote:Thanks again Greg! Just finished coding it up. Here's the money-shot.

User avatar
TickTock
Posts: 1701
Joined: Sat Jun 04, 2011 10:30 pm
Delivery Date: 31 May 2011
Leaf Number: 3626
Location: Queen Creek, Arizona
Contact: Website

Re: Active EV-CAN sampling: cell voltages, pack temperatures

Sun Nov 29, 2015 8:22 am

Glyndwr1998 wrote:Hi ticktock,

I am planning on using a complete leaf pack in a home energy recovery system, still utilising the original bms etc... I am looking at a microcontroller to extract cell voltages, pack voltage and temps exactly as you have done with your code and visual display. I intend to use leafspy as a display but I need a controller and code to switch off the charger and discharge relays to protect the battery, all this can be done utilising the eh outputs from a microcontroller and utilising your code.

Could you please specify what type of controller you used to talk to the bms and extract all the data, plus could you share the code with me please.
I'm not good at programming but I'm sure I could with a few extra lines of code to switch on and off n output to end charge / discharge of cells are high, low or hot.

Many thanks, and I lave the way this thread is helping others.

Best regards, Anthony.

TickTock wrote:Thanks again Greg! Just finished coding it up. Here's the money-shot.

I am using the LPC 1768 mbed. I chose this since it had two canbus tranceivers so i could monitor both carcan and evcan. More details at the mbed site (including the source code):

https://developer.mbed.org/users/TickTock/code/CANary/

You can set up your own account, branch the code, make your edits, compile, and program the device all within your browser.

NocturnalWalt
Posts: 21
Joined: Wed Dec 02, 2015 1:50 am
Delivery Date: 02 Dec 2015

Re: Active EV-CAN sampling: cell voltages, pack temperatures...

Sat Jun 18, 2016 4:16 am

As others have already pointed out, in order to request information from various control units via the Car-CAN bus you just need to know the CAN ID to send the request on and the CAN ID which you will get the response back on. The VCM acts as a gateway to control units on the EV-CAN bus so you can reach control units on both Car-CAN and EV-CAN using just the Car-CAN bus. I've only taken interest in the control units on the EV-CAN bus, so these are the ones I've looked for so far. The first three have previously been identified in the Leaf CAN messages spreadsheet, but here is everything I have found:

Request to VCM – 797, Response from VCM – 79A
Request to LBC – 79B, Response from LBC – 7BB
Request to OBC – 792, Response from OBC - 793
Request to Inv/MC – 784, Response from Inv/MC - 78C
Request to E Shifter – 79D, Response from E Shifter – 7BD
Request to HVAC – 744, Response from HVAC – 764
Request to TCU - ???, Response from TCU ???

The car I was testing on is a base 'S' model so there was no TCU for me to find.

Moving on from there, I thought it would be great if LeafSpy could check the software version number of the various control units. This isn't any more difficult than all the other great stuff that LeafSpy does already. To request the software code from a control module you send the following on one of the CAN IDs listed above:

0x: 02 10 C0 FF FF FF FF FF

This just opens a diagnostics session. The ECU will reply with:

0x: 02 50 C0 FF FF FF FF FF

Then request the ECUs software version with:

0x: 02 21 83 FF FF FF FF FF

For the example of a VCM with software code 237D0-3NF0B the response on CAN ID 79A will be:

0x: 10 1A 61 83 33 4E 46 30

The 10 1A says that there will be 26 bytes in the response excluding the first index byte of each of the following messages. The 61 83 says it is replying to the 83. The 33 4E 46 30 is the interesting part as convert that from hex to ASCII and you'll get 3NF0. The B is missing because you need to request the next line which has already been documented by others:

0x: 30 01 00 FF FF FF FF FF

In our 237D0-3NF0B VCM example the response is:

0x: 21 42 01 41 42 07 33 4E

The 21 is the index which is incremented on subsequent responses. The 42 is our missing B. So that is how to get 3NF0B. There is more information in the other bytes and further responses if you keep requesting the next lines, but I haven't made any sense of that yet. What I am pretty sure of is that 237D0 is not sent. I think this is because every Leaf VCM software code starts with this same number so there is no need to send it. You just need to know that for each control unit its code starts with the following:

VCM Code = 237D0-xxxxx
LBC Code = 293A0-xxxxx
OBC Code = 292C0-xxxxx
Inv/MC Code = 291A0-xxxxx
E Shifter = 31038-xxxxx
HVAC = 27500-xxxxx
TCU = 283B0-xxxxx

The next part I looked for was how to request the serial number of the LBC. I don't know for sure, but I suspect this LBC serial number may be the 'battery ID' that the VCM is paired to in order to decide if it is happy or if it is going to throw a P3102 fault code and limit the motor output. So far I've only looked at three different LBCs. Two were USDM LBCs and both had a serial number starting with SM114 followed by 8 more alphanumeric characters. The third was a JDM LBC with a serial number starting with JT112 then 8 more alphanumeric characters.

Here is how to read the LBCs serial number assuming a diagnostics session has already been opened with the LBC:

Request the LBCs Serial # with:

0x: 02 21 84 FF FF FF FF FF

Using an example of one of the SM114xxxxxxxx serial numbers, the response would be:

0x: 10 16 61 84 32 33 30 53

The first 4 bytes I'll skip as it is the same as deal as reading the software version. The 32 33 30 doesn't appear to be part of the serial number and have been the same on all the LBCs I have checked so far. The 53 (S in ASCII) is the first character in the serial number. The rest of the serial number is in the subsequent messages. You just need to keep requesting the next line. The last character in the serial number has been followed by 0x: 20 20 20 20 on the LBCs I have read so far.

There is other stuff I've found too, but I haven't put any time into making sense of it yet (I probably wont for a while either as my playing has lead me off in another direction). For anyone interested in taking this further themselves, these three requests to the LBC (one at a time) will read the current battery data stored in the LBC.

0x: 02 21 61 FF FF FF FF FF

0x: 02 21 62 FF FF FF FF FF

0x: 02 21 64 FF FF FF FF FF

Turbo3
Gold Member
Posts: 1984
Joined: Mon Jul 19, 2010 8:34 pm
Delivery Date: 12 May 2011
Leaf Number: 002191
Location: San Jose, CA

Re: Active EV-CAN sampling: cell voltages, pack temperatures...

Sat Jul 02, 2016 10:50 am

Here is a new screen I am working on for LeafSpy Pro that displays the version information from each ECU. The battery serial number is also displayed at the top.

The combination meter does not have a value so it is displayed as "XXXXX" to keep the alignment.

Image

caederus
Posts: 9
Joined: Sun Mar 20, 2016 9:34 am
Delivery Date: 01 Mar 2016

Re: Active EV-CAN sampling: cell voltages, pack temperatures...

Sun Jul 03, 2016 5:30 pm

NocturnalWalt wrote:...The first three have previously been identified in the Leaf CAN messages spreadsheet, but here is everything I have found:

Request to VCM – 797, Response from VCM – 79A
Request to LBC – 79B, Response from LBC – 7BB
Request to OBC – 792, Response from OBC - 793
Request to Inv/MC – 784, Response from Inv/MC - 78C
Request to E Shifter – 79D, Response from E Shifter – 7BD
Request to HVAC – 744, Response from HVAC – 764
Request to TCU - ???, Response from TCU ???

The car I was testing on is a base 'S' model so there was no TCU for me to find.

Looking for module versions on my 2015 UK Acenta I get many more responses:

Code: Select all

*70e 83 70f  334e473941014106040401000002279966c6010000000080  3NG9A.A.......'.f.......
*73f 83 761  334e4d304300410701005000000002400000010000000080  3NM0C.A...P....@........
*740 83 760  344e43314103000300000000000058270000000000000080  4NC1A.........X'........
*742 83 762  334e463041444105024e3030314da605000e000000000080  3NF0ADA..N001M..........
*743 83 763  00000000001542517f000000000000001200414a00000080  ......BQ..........AJ....
 744 83 764  334e4d324330420325000000000004300000000000000080  3NM2C0B.%......0........
*745 83 765  334e4c314155420517032321001004800507030700000080  3NL1AUB...#!............
*746 83 783  334e4d3041014403184135303438062a0000000000000080  3NM0A.D..A5048.*........
*747 83 767  344e46304106410403000000000000000002000f00000080  4NF0A.A.................
*74d 83 76d  334e45334110440807000009030006050003000100000080  3NE3A.D.................
*752 83 772  334e4c304108423430000000000000000000000038202083  3NL0A.B40...........8  .
*758 83 778  355a45304121410109ffffffffff0a18ffffffff00000080  5ZE0A!A.................
 784 83 78c  334e46304102300000304143414231443241303100000080  3NF0A.0..0ACAB1D2A01....
 792 83 793  334e4633441041070100000000121007fff0000000000080  3NF3D.A.................
 797 83 79a  334e4c364101414207334e4c364152534555323100000080  3NL6A.AB.3NL6ARSEU21....
 79b 83 7bb  344e463041524205170000000000020e13a1000000000080  4NF0ARB.................
 79d 83 7bd  334e46304202414207310380124703012400001000000080  3NF0B.AB.1...G..$.......

Any idea what the rest are?

NocturnalWalt
Posts: 21
Joined: Wed Dec 02, 2015 1:50 am
Delivery Date: 02 Dec 2015

Re: Active EV-CAN sampling: cell voltages, pack temperatures...

Mon Jul 04, 2016 2:30 am

Turbo3 - Great work on new screen. That's even better than I was hoping for. Thanks very much.

caederus - Although these requests are being made over Car-CAN, my current interests lie on EV-CAN which is why I only identified the control modules that are on EV-CAN. However there are a whole lot of other control modules on Car-CAN that and that is what you're seeing. For example 740 is ABS, 743 is the Instrument cluster etc. If you look at Turbo3's post just before yours then you'll see he has listed other modules he has obviously found (16 in total). You'll also notice that Turbo3 mentioned that the instrument cluster (combination meter) doesn't return a valid value which is exactly what your results show for 743/763. I looks like you've found 17 modules though so I wonder what the extra one that you found is that isn't in Turbo3's list. I suspect Turbo3 will know what the extra control module is as soon as he looks at the data you posted.

Turbo3
Gold Member
Posts: 1984
Joined: Mon Jul 19, 2010 8:34 pm
Delivery Date: 12 May 2011
Leaf Number: 002191
Location: San Jose, CA

Re: Active EV-CAN sampling: cell voltages, pack temperatures...

Mon Jul 04, 2016 8:24 am

My Leaf is a 2011 model so the list above from it does not include the newer VSP ECU that now has a CAN connection and the AVM ECU (All around view).

caederus
Posts: 9
Joined: Sun Mar 20, 2016 9:34 am
Delivery Date: 01 Mar 2016

Re: Active EV-CAN sampling: cell voltages, pack temperatures...

Mon Jul 04, 2016 9:06 am

NocturnalWalt wrote:Although these requests are being made over Car-CAN, my current interests lie on EV-CAN which is why I only identified the control modules that are on EV-CAN.
Can you share what you are working on? I'd be happy to capture logs or run tests to help.

...For example 740 is ABS, 743 is the Instrument cluster etc.
Without invasively isolating individual modules, how do you work out which is which?

...The next part I looked for was how to request the serial number of the LBC. I don't know for sure, but I suspect this LBC serial number may be the 'battery ID' that the VCM is paired to in order to decide if it is happy or if it is going to throw a P3102 fault code and limit the motor output. So far I've only looked at three different LBCs. Two were USDM LBCs and both had a serial number starting with SM114 followed by 8 more alphanumeric characters. The third was a JDM LBC with a serial number starting with JT112 then 8 more alphanumeric characters.
Looking for serial numbers on my 2015 UK Acenta, I only get:

Code: Select all

70e 84 70f  3437305931313458303230303439202020202020          470Y114X020049
742 84 762  3238313458323530343720202020202020202020          2814X25047
744 84 764  3237302020202020202031423853202020202020          270       1B8S
784 84 78c  3232303231313439503130313533483120202020          22021149P10153H1
792 84 793  3233353131313439383032363234202020202020          23511149802624
79b 84 7bb  323330554b313134424d30303133313320202020          230UK114BM001313
79d 84 7bd  3334303231313458333030303832202020202020          3402114X300082

Return to “LEAF CANBus”