LEAF CANbus decoding. (Open discussion)

[nickname3]

Always is a good contribution give back to the community if somethig has been derived from the community => yes please

Here you are:

Sketch for Arduino IDE:

#include <SPI.h> //connect libraries
#include <mcp2515.h>
struct can_frame canMsg1;
struct can_frame canMsg2;
struct can_frame canMsg3;
MCP2515 mcp2515(10);
void setup() {

canMsg1.can_id = 0x681; //write commands to send here...
canMsg1.can_dlc = 8;
canMsg1.data[0] = 0x04;
canMsg1.data[1] = 0x10;
canMsg1.data[2] = 0x40;
canMsg1.data[3] = 0x0D;
canMsg1.data[4] = 0xAB;
canMsg1.data[5] = 0xFF;
canMsg1.data[6] = 0xFF;
canMsg1.data[7] = 0xFF;

canMsg2.can_id = 0x681;
canMsg2.can_dlc = 8;
canMsg2.data[0] = 0x04;
canMsg2.data[1] = 0x20;
canMsg2.data[2] = 0x40;
canMsg2.data[3] = 0x0D;
canMsg2.data[4] = 0xAB;
canMsg2.data[5] = 0xFF;
canMsg2.data[6] = 0xFF;
canMsg2.data[7] = 0xFF;

canMsg3.can_id = 0x681;
canMsg3.can_dlc = 8;
canMsg3.data[0] = 0x04;
canMsg3.data[1] = 0x30;
canMsg3.data[2] = 0x40;
canMsg3.data[3] = 0x0D;
canMsg3.data[4] = 0xAB;
canMsg3.data[5] = 0xFF;
canMsg3.data[6] = 0xFF;
canMsg3.data[7] = 0xFF;

while (!Serial);
Serial.begin(115200);
SPI.begin();
mcp2515.reset();
mcp2515.setBitrate (CAN_500KBPS, MCP_8MHZ); //check your quartz on mcp2515
mcp2515.setNormalMode();
Serial.println("Killing blue screen...");
}

void loop() {
delay(8000); //delay for starting vehicle 8s
mcp2515.sendMessage(&canMsg1);
Serial.println("Message 1 sent");
delay(100);
mcp2515.sendMessage(&canMsg2);
Serial.println("Message 2 sent");
delay(100);
mcp2515.sendMessage(&canMsg3);
Serial.println("Message 3 sent");
delay(100);
Serial.println("Blue screen was killed!");

while (true);
}

 

[ginetto]

Here you are:

Thanks probably should connect to ODBII pin 6 (canH) and 14(canL) instead of 3 and 11 ? or 2 and 11 are can lines for infotainement?

 

[nickname3]

Here you are:

Thanks probably should connect to ODBII pin 6 (canH) and 14(canL) instead of 3 and 11 ? or 2 and 11 are can lines for infotainement?

Yes, 3 and 11 - it's AV-CAN. More details in first post of this theme. https://mynissanleaf.com/viewtopic.php?f=44&t=4131#p97509
Now I research, how automaticly to connect to different CAN buses of LEAF (primary, EV, AV). The first thing that comes is dual relay module. But it's connect just to 2 buses of 3

 

[bearer]

Here you are:

High five! btw you can compact the code a fair bit by moving the can data to the struct initialization, ref https://pastebin.com/vH0iU6hb

(half way done with a easyeda layout for stm8, mcp2515 and sn65hvd230, just need to find a solution for 12v to 3.3v thats in jlcpcb's basic selection. will share on the new oshwlab.com site when done, guessing it'll take a while as i'll probably have to find some obscure chinese dc/dc converter to avoid the extended part fee. under $3 in parts so far or less than $40 for 10 boards assembled)

 

[JeremyW]

Here you are:

Thanks probably should connect to ODBII pin 6 (canH) and 14(canL) instead of 3 and 11 ? or 2 and 11 are can lines for infotainement?

Yes, 3 and 11 - it's AV-CAN. More details in first post of this theme. https://mynissanleaf.com/viewtopic.php?f=44&t=4131#p97509
Now I research, how automaticly to connect to different CAN buses of LEAF (primary, EV, AV). The first thing that comes is dual relay module. But it's connect just to 2 buses of 3

You could use multiple MCP2515s on the SPI bus. The library supports at least 2. Might run out of memory with 3.

https://github.com/coryjfowler/MCP_CAN_lib/blob/master/examples/Dual_CAN/Dual_CAN.ino

 

[bearer]

Thanks probably should connect to ODBII pin 6 (canH) and 14(canL) instead of 3 and 11 ? or 2 and 11 are can lines for infotainement?

Yes, 3 and 11 - it's AV-CAN. More details in first post of this theme. https://mynissanleaf.com/viewtopic.php?f=44&t=4131#p97509
Now I research, how automaticly to connect to different CAN buses of LEAF (primary, EV, AV). The first thing that comes is dual relay module. But it's connect just to 2 buses of 3

You could use multiple MCP2515s on the SPI bus. The library supports at least 2. Might run out of memory with 3.

https://github.com/coryjfowler/MCP_CAN_lib/blob/master/examples/Dual_CAN/Dual_CAN.ino

or you could use one mcp2515 with three SN65HVD231DR and make sure to put two to sleep at the time?

 

[bearer]

I'm using Raspberry Pi 4 + 2515 + OBD + Arduino and nothing worked.

Pi + 2515 + OBD? Not sure i follow, the OBD adapter you link to is wireless bluetooth so no need for the 2515. And if you're trying to use a 2515 module with tja1050 transciever i think you'll have problems with the transciever needing 5v?

 

[bearer]

By injecting a CAN-message to the AV-CAN, it is possible to bypass this nag-screen and go straight to radio/maps.

I just wondered, bypassing it this way might be akin to pressing cancel and not ok - resulting in telemetry not getting uploaded to nissan for those who use carwings for that sort of thing?

 

[Dala]

By injecting a CAN-message to the AV-CAN, it is possible to bypass this nag-screen and go straight to radio/maps.

I just wondered, bypassing it this way might be akin to pressing cancel and not ok - resulting in telemetry not getting uploaded to nissan for those who use carwings for that sort of thing?

No clue. Nobody has reproted back any issues yet. Might be fine, might not. Time will tell!

I recently did some reverse engineering on the ZE1 EV-CAN, made a very boring youtube video on the process. I don't recommend you watch this one.
https://www.youtube.com/watch?v=ty1VYmNWXFc

 

[bearer]

Might be fine, might not. Time will tell!

Its not a problem as such, at least not bigger than not pressing ok in the first place. I reported the wrong mileage on my leaf once because of a sizeable discrepancy between carwings history and odometer in car - and I presume that is because I hardly ever press OK. Or it could be just the way carwings doesn't work, anyways it might be worth while making a note of it, in case it is an issue for some.

 

[lucasfr]

Hi, I'm not using all 3 at the same time. I am using Pi + OBD or Pi + 2515 (modified to 5V). I would like to warn you that I have already made progress. But now I need the OBD command table saying what is in the vehicle data.
If anyone can help I appreciate it.

Thanks.

I'm using Raspberry Pi 4 + 2515 + OBD + Arduino and nothing worked.

Pi + 2515 + OBD? Not sure i follow, the OBD adapter you link to is wireless bluetooth so no need for the 2515. And if you're trying to use a 2515 module with tja1050 transciever i think you'll have problems with the transciever needing 5v?

 

[ginetto]

But now I need the OBD command table saying what is in the vehicle data.

are you looking this db? https://github.com/dalathegreat/leaf_can_bus_messages

 

[bearer]

ref hardware these were pretty cheap, I stumbled onto when looking for CH55x dev boards and ordered a few of those as well
$6.20 https://www.electrodragon.com/product/can-usb-debugger-board/
$3.50 https://www.electrodragon.com/product/raspberry-pi-rs-485-can-shield/

 

[pottorf]

But now I need the OBD command table saying what is in the vehicle data.

are you looking this db? https://github.com/dalathegreat/leaf_can_bus_messages

this db is pretty confusing and not helpful, since its not really clear what is the msgID in the OBDII request you can send to the car or what is the msgID in the response you get. I just needed to know how the OBDII frame is divided, eg. when you send the request 0210C0 to the LEAF, what does 02 means, 10, etc.

 

[bearer]

I just needed to know how the OBDII frame is divided,

If you look up the message id in the .dbc file it will show how the frame for that message is divided and encoded? or are you referring to something higher level like UDS?

 

[Dala]

The .DBC file I maintain is for passive listening to EV/AV/CAR-CAN. If you start to send active data-requests you are going to need something completely different, I haven't had time to make such a file yet (and I'm not even sure that it is possible with the Kvaser Database Editor).

Manually decrypting it is your only option. Check how OVMS has done their implementation on active polling https://github.com/openvehicles/Open-Vehicle-Monitoring-System-3/blob/master/vehicle/OVMS.V3/components/vehicle_nissanleaf/src/vehicle_nissanleaf.cpp

 

[pottorf]

Manually decrypting it is your only option. Check how OVMS has done their implementation on active polling https://github.com/openvehicles/Open-Vehicle-Monitoring-System-3/blob/master/vehicle/OVMS.V3/components/vehicle_nissanleaf/src/vehicle_nissanleaf.cpp

Yeah, I checked their implementation and the only thing I want to know is where did they get those PID numbers, for VIN, QC, starting at line 54.

 

[Dala]

Manually decrypting it is your only option. Check how OVMS has done their implementation on active polling https://github.com/openvehicles/Open-Vehicle-Monitoring-System-3/blob/master/vehicle/OVMS.V3/components/vehicle_nissanleaf/src/vehicle_nissanleaf.cpp

Yeah, I checked their implementation and the only thing I want to know is where did they get those PID numbers, for VIN, QC, starting at line 54.

No clue. You could take a CAN-dump with an OBD2 adapter connected running Leafspy. That way you would also get the PIDs for different functions.

 

[pottorf]

No clue. You could take a CAN-dump with an OBD2 adapter connected running Leafspy. That way you would also get the PIDs for different functions.

Already did that, but its not easy to discover what each PID stands for :|

 

[gorgo]

I recently did some reverse engineering on the ZE1 EV-CAN, made a very boring youtube video on the process. I don't recommend you watch this one.
https://www.youtube.com/watch?v=ty1VYmNWXFc

Hi Dala! I loved your 'very boring' video
At the beginning I wondered "Wth? How did he get passive CAN messages from the Leaf 2018?", then you reveal that the sender had probably got access to the internal wires. Seems fair.
I'm curious now how you usually proceed from raw bytes to ECU meaningful values without Nissan's instructions.

I also read on OVMS Leaf 2018 issue (https://github.com/openvehicles/Open-Vehicle-Monitoring-System-3/issues/323) what caederus-ovms reported about HVBATT data even if I'm not fully understanding every variables there. Anyone knows, for example, what's the insulation value or flash or mode?