Active EV-CAN sampling: cell voltages, pack temperatures...

My Nissan Leaf Forum

Help Support My Nissan Leaf Forum:

This site may earn a commission from merchant affiliate links, including eBay, Amazon, and others.
GregH said:
TickTock said:
GregH said:
With the help of a few LeafDD customers in colder climates, we can now extend the temperature translation table (first post of this thread) down to 0C.. and soon hopefully confirm down to -10C..
Very nice! These remain surprisingly linear - looks like extrapolation should be valid outside this range.

I know! Personally I'm shocked it's still 10 clicks per degree C all the way down to 0C.. I would have thought for sure the nonlinearity of the thermistor would have resulted in 12 or 13 clicks per degree C down in the colder realm (as it is confirmed 8 or 9 on the hot side). Could it be the Leaf's own temperature calcs are lazily linear? And in the end, do we care what the real temps are or what the trigger points for things like temp bars and battery heaters is?
I suppose the curvature may be there but Nissan decided a linear fit was good enough. We should sanity check the result against an independent thermometer at several points.
 
TickTock said:
GregH said:
I know! Personally I'm shocked it's still 10 clicks per degree C all the way down to 0C.. I would have thought for sure the nonlinearity of the thermistor would have resulted in 12 or 13 clicks per degree C down in the colder realm (as it is confirmed 8 or 9 on the hot side). Could it be the Leaf's own temperature calcs are lazily linear? And in the end, do we care what the real temps are or what the trigger points for things like temp bars and battery heaters is?
I suppose the curvature may be there but Nissan decided a linear fit was good enough. We should sanity check the result against an independent thermometer at several points.
Check the published thermistor curve in the service manual EVB-19 (2013) or EVB-22 (2012)... Sure doesn't look flat from 0 to 10C to me!
 
GregH said:
Check the published thermistor curve in the service manual EVB-19 (2013) or EVB-22 (2012)... Sure doesn't look flat from 0 to 10C to me!
I appears the ADC and degreesC value on the canbus are linearized but the value displayed on the eyebrow has been curvature corrected. I shut the passenger door on a thermocouple such that it sits about 1cm away from the door just above the side mirror. Monitoring with my Fluke which has 0.1 deg accuracy, I can say that the eyebrow readout matches very well with the Fluke *once equilibrium is reached*. It takes about 10 minutes for the dash readout to settle, but when it does it is within 1 degree of the Fluke measurement (the Fluke responds very quickly, within seconds) however the canbus readout is often as much as 5 degrees off. For example, this morning, after being on the road for about 20 minutes, I measured 43F outside and read the same on the dash, but got 38F from the canbus. I think we need to start collecting some more datapoints of *real* temperature to fill out our lookup table properly. My data suggests the dash is a good measurement - as long as it has been at reasonably constant temperature for at least 10 minutes. So if any of the folks living the the north can grab a datapoint or two along with the canbus temp at the low extreme, I can get the upper extreme here in a few months and we should be able to fit a curve. Remember, only to trust the dash after you've been driving at least 10 minutes.
 
TickTock said:
Greg, maybe you can start tracking this, too, in the OP. The 3C entry, then, would be:

3 degrees C starts at 690 (6 degrees C actual)
Hmm.. you mean based on our eyeball reading of the thermistor curve?
A few people with LeafDD have the new software that shows temps under 0C, and I have a few readings, but not enough yet to confirm the -2 to -1 or -3 to -2 transitions. I'd like to think this was just sloppy software (on Nissan's part) down to 0C and there's a different slope below 0C but I have yet to confirm that.
 
GregH said:
TickTock said:
Greg, maybe you can start tracking this, too, in the OP. The 3C entry, then, would be:

3 degrees C starts at 690 (6 degrees C actual)
Hmm.. you mean based on our eyeball reading of the thermistor curve?
A few people with LeafDD have the new software that shows temps under 0C, and I have a few readings, but not enough yet to confirm the -2 to -1 or -3 to -2 transitions. I'd like to think this was just sloppy software (on Nissan's part) down to 0C and there's a different slope below 0C but I have yet to confirm that.
No, that was measured using a Fluke multimeter with a thermocouple probe outside the cabin (see my previous post).
 
About Group 6,

I've been having a bit of disassembly fun.

I was trying to find adequate shunt resistors on the BMS board and I didn't see any.

14095154092_49473b58ab_z.jpg


13911625099_be1a64503a_z.jpg



https://www.flickr.com/photos/jaesin/sets/72157644497791245/

The wires are also quite small for shunting.

Am I missing something?
 
Each of the 12 main chips has four 430 ohm ("431") resistors, so those might be the
shunt resistors for 48 modules or 48 cell pairs. Is there another BMS board to handle the
other 48 cell pairs? Are there any parts on the other side of the board?

A shunt of 10 ma is not much current, and 240 mah per day is
only about 1 watt-hour per day, so not very rapid equalization, but maybe they thought
that 0.3 kWh a year would be sufficient?

Just an uninformed guess.
 
Is there a reasonably comprehensive list of the CAN 'active' query codes? I'm talking about the parameters for request codes like 797 and 745. I read through the google docs spreadsheet of CAN codes and have gotten through half of the 44 (ouch!) pages of the main CAN bus topic in the forum and have found only a dribbling of these codes (about 7 so far). I'm not sure of the exact terminology for these: polling codes, request/response codes, PIDs (Parameter IDs). So not knowing the official terminology I'm not sure exactly what to search for.
 
Hi ticktock,

I am planning on using a complete leaf pack in a home energy recovery system, still utilising the original bms etc... I am looking at a microcontroller to extract cell voltages, pack voltage and temps exactly as you have done with your code and visual display. I intend to use leafspy as a display but I need a controller and code to switch off the charger and discharge relays to protect the battery, all this can be done utilising the eh outputs from a microcontroller and utilising your code.

Could you please specify what type of controller you used to talk to the bms and extract all the data, plus could you share the code with me please.
I'm not good at programming but I'm sure I could with a few extra lines of code to switch on and off n output to end charge / discharge of cells are high, low or hot.

Many thanks, and I lave the way this thread is helping others.

Best regards, Anthony.

TickTock said:
Thanks again Greg! Just finished coding it up. Here's the money-shot.
 
Glyndwr1998 said:
Hi ticktock,

I am planning on using a complete leaf pack in a home energy recovery system, still utilising the original bms etc... I am looking at a microcontroller to extract cell voltages, pack voltage and temps exactly as you have done with your code and visual display. I intend to use leafspy as a display but I need a controller and code to switch off the charger and discharge relays to protect the battery, all this can be done utilising the eh outputs from a microcontroller and utilising your code.

Could you please specify what type of controller you used to talk to the bms and extract all the data, plus could you share the code with me please.
I'm not good at programming but I'm sure I could with a few extra lines of code to switch on and off n output to end charge / discharge of cells are high, low or hot.

Many thanks, and I lave the way this thread is helping others.

Best regards, Anthony.

TickTock said:
Thanks again Greg! Just finished coding it up. Here's the money-shot.
I am using the LPC 1768 mbed. I chose this since it had two canbus tranceivers so i could monitor both carcan and evcan. More details at the mbed site (including the source code):

https://developer.mbed.org/users/TickTock/code/CANary/

You can set up your own account, branch the code, make your edits, compile, and program the device all within your browser.
 
As others have already pointed out, in order to request information from various control units via the Car-CAN bus you just need to know the CAN ID to send the request on and the CAN ID which you will get the response back on. The VCM acts as a gateway to control units on the EV-CAN bus so you can reach control units on both Car-CAN and EV-CAN using just the Car-CAN bus. I've only taken interest in the control units on the EV-CAN bus, so these are the ones I've looked for so far. The first three have previously been identified in the Leaf CAN messages spreadsheet, but here is everything I have found:

Request to VCM – 797, Response from VCM – 79A
Request to LBC – 79B, Response from LBC – 7BB
Request to OBC – 792, Response from OBC - 793
Request to Inv/MC – 784, Response from Inv/MC - 78C
Request to E Shifter – 79D, Response from E Shifter – 7BD
Request to HVAC – 744, Response from HVAC – 764
Request to TCU - ???, Response from TCU ???

The car I was testing on is a base 'S' model so there was no TCU for me to find.

Moving on from there, I thought it would be great if LeafSpy could check the software version number of the various control units. This isn't any more difficult than all the other great stuff that LeafSpy does already. To request the software code from a control module you send the following on one of the CAN IDs listed above:

0x: 02 10 C0 FF FF FF FF FF

This just opens a diagnostics session. The ECU will reply with:

0x: 02 50 C0 FF FF FF FF FF

Then request the ECUs software version with:

0x: 02 21 83 FF FF FF FF FF

For the example of a VCM with software code 237D0-3NF0B the response on CAN ID 79A will be:

0x: 10 1A 61 83 33 4E 46 30

The 10 1A says that there will be 26 bytes in the response excluding the first index byte of each of the following messages. The 61 83 says it is replying to the 83. The 33 4E 46 30 is the interesting part as convert that from hex to ASCII and you'll get 3NF0. The B is missing because you need to request the next line which has already been documented by others:

0x: 30 01 00 FF FF FF FF FF

In our 237D0-3NF0B VCM example the response is:

0x: 21 42 01 41 42 07 33 4E

The 21 is the index which is incremented on subsequent responses. The 42 is our missing B. So that is how to get 3NF0B. There is more information in the other bytes and further responses if you keep requesting the next lines, but I haven't made any sense of that yet. What I am pretty sure of is that 237D0 is not sent. I think this is because every Leaf VCM software code starts with this same number so there is no need to send it. You just need to know that for each control unit its code starts with the following:

VCM Code = 237D0-xxxxx
LBC Code = 293A0-xxxxx
OBC Code = 292C0-xxxxx
Inv/MC Code = 291A0-xxxxx
E Shifter = 31038-xxxxx
HVAC = 27500-xxxxx
TCU = 283B0-xxxxx

The next part I looked for was how to request the serial number of the LBC. I don't know for sure, but I suspect this LBC serial number may be the 'battery ID' that the VCM is paired to in order to decide if it is happy or if it is going to throw a P3102 fault code and limit the motor output. So far I've only looked at three different LBCs. Two were USDM LBCs and both had a serial number starting with SM114 followed by 8 more alphanumeric characters. The third was a JDM LBC with a serial number starting with JT112 then 8 more alphanumeric characters.

Here is how to read the LBCs serial number assuming a diagnostics session has already been opened with the LBC:

Request the LBCs Serial # with:

0x: 02 21 84 FF FF FF FF FF

Using an example of one of the SM114xxxxxxxx serial numbers, the response would be:

0x: 10 16 61 84 32 33 30 53

The first 4 bytes I'll skip as it is the same as deal as reading the software version. The 32 33 30 doesn't appear to be part of the serial number and have been the same on all the LBCs I have checked so far. The 53 (S in ASCII) is the first character in the serial number. The rest of the serial number is in the subsequent messages. You just need to keep requesting the next line. The last character in the serial number has been followed by 0x: 20 20 20 20 on the LBCs I have read so far.

There is other stuff I've found too, but I haven't put any time into making sense of it yet (I probably wont for a while either as my playing has lead me off in another direction). For anyone interested in taking this further themselves, these three requests to the LBC (one at a time) will read the current battery data stored in the LBC.

0x: 02 21 61 FF FF FF FF FF

0x: 02 21 62 FF FF FF FF FF

0x: 02 21 64 FF FF FF FF FF
 
Here is a new screen I am working on for LeafSpy Pro that displays the version information from each ECU. The battery serial number is also displayed at the top.

The combination meter does not have a value so it is displayed as "XXXXX" to keep the alignment.

TK5HdB.png
 
NocturnalWalt said:
...The first three have previously been identified in the Leaf CAN messages spreadsheet, but here is everything I have found:

Request to VCM – 797, Response from VCM – 79A
Request to LBC – 79B, Response from LBC – 7BB
Request to OBC – 792, Response from OBC - 793
Request to Inv/MC – 784, Response from Inv/MC - 78C
Request to E Shifter – 79D, Response from E Shifter – 7BD
Request to HVAC – 744, Response from HVAC – 764
Request to TCU - ???, Response from TCU ???

The car I was testing on is a base 'S' model so there was no TCU for me to find.
Looking for module versions on my 2015 UK Acenta I get many more responses:
Code:
*70e 83 70f  334e473941014106040401000002279966c6010000000080  3NG9A.A.......'.f.......
*73f 83 761  334e4d304300410701005000000002400000010000000080  3NM0C.A...P....@........
*740 83 760  344e43314103000300000000000058270000000000000080  4NC1A.........X'........
*742 83 762  334e463041444105024e3030314da605000e000000000080  3NF0ADA..N001M..........
*743 83 763  00000000001542517f000000000000001200414a00000080  ......BQ..........AJ....
 744 83 764  334e4d324330420325000000000004300000000000000080  3NM2C0B.%......0........
*745 83 765  334e4c314155420517032321001004800507030700000080  3NL1AUB...#!............
*746 83 783  334e4d3041014403184135303438062a0000000000000080  3NM0A.D..A5048.*........
*747 83 767  344e46304106410403000000000000000002000f00000080  4NF0A.A.................
*74d 83 76d  334e45334110440807000009030006050003000100000080  3NE3A.D.................
*752 83 772  334e4c304108423430000000000000000000000038202083  3NL0A.B40...........8  .
*758 83 778  355a45304121410109ffffffffff0a18ffffffff00000080  5ZE0A!A.................
 784 83 78c  334e46304102300000304143414231443241303100000080  3NF0A.0..0ACAB1D2A01....
 792 83 793  334e4633441041070100000000121007fff0000000000080  3NF3D.A.................
 797 83 79a  334e4c364101414207334e4c364152534555323100000080  3NL6A.AB.3NL6ARSEU21....
 79b 83 7bb  344e463041524205170000000000020e13a1000000000080  4NF0ARB.................
 79d 83 7bd  334e46304202414207310380124703012400001000000080  3NF0B.AB.1...G..$.......
Any idea what the rest are?
 
Turbo3 - Great work on new screen. That's even better than I was hoping for. Thanks very much.

caederus - Although these requests are being made over Car-CAN, my current interests lie on EV-CAN which is why I only identified the control modules that are on EV-CAN. However there are a whole lot of other control modules on Car-CAN that and that is what you're seeing. For example 740 is ABS, 743 is the Instrument cluster etc. If you look at Turbo3's post just before yours then you'll see he has listed other modules he has obviously found (16 in total). You'll also notice that Turbo3 mentioned that the instrument cluster (combination meter) doesn't return a valid value which is exactly what your results show for 743/763. I looks like you've found 17 modules though so I wonder what the extra one that you found is that isn't in Turbo3's list. I suspect Turbo3 will know what the extra control module is as soon as he looks at the data you posted.
 
NocturnalWalt said:
Although these requests are being made over Car-CAN, my current interests lie on EV-CAN which is why I only identified the control modules that are on EV-CAN.
Can you share what you are working on? I'd be happy to capture logs or run tests to help.

...For example 740 is ABS, 743 is the Instrument cluster etc.
Without invasively isolating individual modules, how do you work out which is which?

...The next part I looked for was how to request the serial number of the LBC. I don't know for sure, but I suspect this LBC serial number may be the 'battery ID' that the VCM is paired to in order to decide if it is happy or if it is going to throw a P3102 fault code and limit the motor output. So far I've only looked at three different LBCs. Two were USDM LBCs and both had a serial number starting with SM114 followed by 8 more alphanumeric characters. The third was a JDM LBC with a serial number starting with JT112 then 8 more alphanumeric characters.
Looking for serial numbers on my 2015 UK Acenta, I only get:
Code:
70e 84 70f  3437305931313458303230303439202020202020          470Y114X020049
742 84 762  3238313458323530343720202020202020202020          2814X25047
744 84 764  3237302020202020202031423853202020202020          270       1B8S
784 84 78c  3232303231313439503130313533483120202020          22021149P10153H1
792 84 793  3233353131313439383032363234202020202020          23511149802624
79b 84 7bb  323330554b313134424d30303133313320202020          230UK114BM001313
79d 84 7bd  3334303231313458333030303832202020202020          3402114X300082
 
Back
Top