TheEvKid
Posts: 6
Joined: Mon Mar 19, 2012 1:33 pm
Delivery Date: 15 May 2011
Leaf Number: 4789

Anybody mess with the CAN Commanded Torque Message ID 0x1D4?

Mon Mar 19, 2012 1:43 pm

Has anyone messed around with the CAN ID 0x1D4? This message contains the commanded torques request.
I have a desire to command specific torque request from a laptop to see what is the actual torque at the wheels.
The problem is that darn CRC checksum!!

Has anyone determined, or even got a clue of what CRC algorithm is used? I sure would like to hack this message just for grins!

Thanks!

User avatar
TickTock
Posts: 1701
Joined: Sat Jun 04, 2011 10:30 pm
Delivery Date: 31 May 2011
Leaf Number: 3626
Location: Queen Creek, Arizona
Contact: Website

Re: Anybody mess with the CAN Commanded Torque Message ID 0x

Mon Mar 19, 2012 1:48 pm

No. I only observed it and guessed that it was filtered motor amps. How were you able to identify it as Commanded Torque? Do you have definitions of any of the others?

TheEvKid
Posts: 6
Joined: Mon Mar 19, 2012 1:33 pm
Delivery Date: 15 May 2011
Leaf Number: 4789

Re: Anybody mess with the CAN Commanded Torque Message ID 0x

Mon Mar 19, 2012 2:02 pm

Using CAN utils I have observed the torque request under normal operating conditions.
Now I would like to create my own torque requests using the CAN utility.
The problem is the checksum algorithm. I have not reversed engineered that CRC algorithm yet.

My suspension is Nissan uses this CRC checksum to encript the message. They may also use this type of algorithm in other messages. I have not checked.

I am trying to break this CRC algorithm.

Any suggestions???

TY!

Smidge204
Posts: 940
Joined: Wed Nov 24, 2010 1:42 pm

Re: Anybody mess with the CAN Commanded Torque Message ID 0x

Mon Mar 19, 2012 3:38 pm

CRCs aren't used to encrypt, but whatever :P

Can you provide a sample data packet (preferably several) to look at?
=Smidge=

User avatar
TickTock
Posts: 1701
Joined: Sat Jun 04, 2011 10:30 pm
Delivery Date: 31 May 2011
Leaf Number: 3626
Location: Queen Creek, Arizona
Contact: Website

Re: Anybody mess with the CAN Commanded Torque Message ID 0x

Mon Mar 19, 2012 3:40 pm

I am guessing you are guessing that the last byte is the crc. I assume you're tried basic summing and summing after applying an XOR? Beyond that, the next level usually involves a rolling lfsr but given the high error rate of the can bus (due to collisions) I really doubt they would go there. The main reason for the crc is to prevent accidental wrong messages due to the same collisions.

What made you think it is a torque command rather than just a torque message?

TheEvKid
Posts: 6
Joined: Mon Mar 19, 2012 1:33 pm
Delivery Date: 15 May 2011
Leaf Number: 4789

Re: Anybody mess with the CAN Commanded Torque Message ID 0x

Wed Mar 21, 2012 5:41 am

I have logged the CAN traffic while applying a load to the vehicle, and wide open throttle. I watched the torque command increase to the maximum as long as there was a heavy load. When the load decreased, the torques command decreased as well. I have reverse engineered most of this command (0x1D4). But I cannot solve the byte 8 (last byte). I know there is a rolling counter, and with nothing else changing, as the counter steps, the checksum(CRC)...the last byte changes too.

Here is some examples(torque not determined), the only changes are the counter(0,1,2,3) which is located in the two MSBs of lower nibble :

F7 07 00 00 07 44 00 D0
F7 07 00 00 47 44 00 17
F7 07 00 00 87 44 00 DB
F7 07 00 00 C7 44 00 1C

F7 07 00 00 07 44 30 70
F7 07 00 00 47 44 30 B7
F7 07 00 00 87 44 30 7B
F7 07 00 00 C7 44 30 BC

Any suggestions regarding the calculations of the last byte?

Does anyone have a binary image of either the VCM, or the motor controller with a communication log involving the controller image?

User avatar
garygid
Gold Member
Posts: 12448
Joined: Wed Apr 21, 2010 8:10 am
Delivery Date: 29 Mar 2011
Leaf Number: 000855
Location: Laguna Hills, Orange Co, CA

Re: Anybody mess with the CAN Commanded Torque Message ID 0x

Wed Mar 21, 2012 7:54 am

Need to see more sequential 1D4 commands to have a better chance of solving the puzzle, maybe 100 or 200.

What do you intend to do when you "solve" this Data8 problem?
See SOC/GID-Meter and CAN-Do Info
2011 LEAF, sold in 2015
2010 Prius, 2014 silver Tesla S
Nissan EVSE, mod to 240/120v 16A
PU: SDG&E
Solar PV: 33 x 225W -> 7 kW max AC
To Sell: X-treme 5000Li EV motorcycle

User avatar
garygid
Gold Member
Posts: 12448
Joined: Wed Apr 21, 2010 8:10 am
Delivery Date: 29 Mar 2011
Leaf Number: 000855
Location: Laguna Hills, Orange Co, CA

Re: Anybody mess with the CAN Commanded Torque Message ID 0x

Wed Mar 21, 2012 8:36 am

The 3-CAN Logs of a "short Drive" show 29,000 sequential EV:1D4 commands (original LEAF firmware).

While moving, the D8 byte values "splatter" over essentially all 0x00 to 0xFF values.

Note that 1DA and 1DB have similar "Security" bytes in D8.

See: www.wwwsite.com/puzzles/cando/
See SOC/GID-Meter and CAN-Do Info
2011 LEAF, sold in 2015
2010 Prius, 2014 silver Tesla S
Nissan EVSE, mod to 240/120v 16A
PU: SDG&E
Solar PV: 33 x 225W -> 7 kW max AC
To Sell: X-treme 5000Li EV motorcycle

User avatar
garygid
Gold Member
Posts: 12448
Joined: Wed Apr 21, 2010 8:10 am
Delivery Date: 29 Mar 2011
Leaf Number: 000855
Location: Laguna Hills, Orange Co, CA

Re: Anybody mess with the CAN Commanded Torque Message ID 0x

Wed Mar 21, 2012 8:46 am

If you plan to "control the motor from the laptop", how will you stop the VCM from trying to control the motor, disconnect the inverter from the EV-CAN bus?
See SOC/GID-Meter and CAN-Do Info
2011 LEAF, sold in 2015
2010 Prius, 2014 silver Tesla S
Nissan EVSE, mod to 240/120v 16A
PU: SDG&E
Solar PV: 33 x 225W -> 7 kW max AC
To Sell: X-treme 5000Li EV motorcycle

User avatar
garygid
Gold Member
Posts: 12448
Joined: Wed Apr 21, 2010 8:10 am
Delivery Date: 29 Mar 2011
Leaf Number: 000855
Location: Laguna Hills, Orange Co, CA

Re: Anybody mess with the CAN Commanded Torque Message ID 0x

Wed Mar 21, 2012 8:47 am

Have you tried to pull out your VCM and read its Flash memory?
See SOC/GID-Meter and CAN-Do Info
2011 LEAF, sold in 2015
2010 Prius, 2014 silver Tesla S
Nissan EVSE, mod to 240/120v 16A
PU: SDG&E
Solar PV: 33 x 225W -> 7 kW max AC
To Sell: X-treme 5000Li EV motorcycle

Return to “Engineering”