Reverse engineering BMS Firmware / Reflashing BMS

[safetyuggs]

BMS Firmware Version - CRC reflash IV:
5SA2AVB - A6BC
3NK2ARB - C5ED
3NK0BRB - D30E
3NA0DBE - D91C

 

[Geofizik]

АZЕО-24
3NF1ARBQ-9BF7

 

[konrin]

my leaf ze0, 2011
3NA0DPBE - C01D

 

[Ianlighting]

Here’s photos of a 60kWh BMS from the UK (not 62, I believe in 2023, they changed to stating only 60).

I’ve realised the photos haven’t come out too well so didn’t upload the others. The resolution isn’t great. If this is of use, let me know and I’ll get the lid off and focus on the area you need with better lighting.

The outside case only has the single label from Marelli Corporation, with a white plastic base.

 

[explorer232]

If you have a second, and an obd2 device, could you please post your Firmware version and CRC Reflash IV? I suspect they're tied to the firmware and not random (based on the limited number of BMS's I've checked)

Reason being, we can only generate the re-flashing seed/key pairs on a PC right now, so if the CRC IV's are tied to the firmware version, we can pre-calculate a seed-key pair file to distribute with the android reflash app - otherwise we'll need to use a web server to provide keys (which is fine, I'd just prefer it stand alone & offline) - once we get the right BMS to reflash, we can extract the full stand alone C function but right now, we're tied to the PC.

Android 12 or higher only for now.

Hi,
my code for 72_81 crypto updated - its android compatible solution now (no need additional pc to generate seed/key pairs anymore) so you can add flashing function to android app

I see so many BMS here but I can't help with flashing procedure because I don't have BMS for testing

 

[renateves]

V8 now supports Android as far back as OS Version 5.

Thank you very much for your work and for sharing. I have read almost the 13 pages and with a 32% SOH in a Leaf 2014, i have installed the app and try it. Apply the "new" SOH (75%) with success!! I'm still nervous... holly #"%$&"#!
Tomorrow i will test it on the road. From 20kms of estimative, i have got 47!!

PS: Thanks Daniel for your "directions"

 

[dfj]

Hi,
my code for 72_81 crypto updated - its android compatible solution now (no need additional pc to generate seed/key pairs anymore) so you can add flashing function to android app

I see so many BMS here but I can't help with flashing procedure because I don't have BMS for testing

Hi. One question about ECU Flash. Is the method universal across all ECUs in the car, or each one has its special way?

 

[renateves]

Quick update: it go back to the "normal" SOH (32%) and the DTC appear again (P33D4 & P3180)

 

[safetyuggs]

Hi. One question about ECU Flash. Is the method universal across all ECUs in the car, or each one has its special way?

They're all different unfortuantely, but BMS is the hardest, VCM is much easier

 

[safetyuggs]

Quick update: it go back to the "normal" SOH (32%) and the DTC appear again (P33D4 & P3180)

What are those DTCs?

 

[renateves]

Short reason that i have found:

...the P33D4 is "replace the Li-Ion battery because its internal resistance is going up" unfortunately. The P3180 is "there is an error code in the battery controller" i.e. the P33D4 code.

 

[safetyuggs]

32% is fairly low, it's probably a genuine DTC once it hits a certain threshold

 

[Geduxaz]

Quick update: it go back to the "normal" SOH (32%) and the DTC appear again (P33D4 & P3180)

This does not magicaly fix your battery. This work guys are doing is for posibility to adjust BMS for projects and upgraded cells.

 

[erikrangel]

Esto no arregla mágicamente la batería. Este trabajo que están haciendo los chicos es para poder ajustar el BMS para proyectos y celdas mejoradas.

yola ami si me ayudaron la reseteada de las baterías un leaf con 5 barras ya casi no regenera después del reseteo ya regenera los 5 círculos y la batería subió de 8kw a 18kw algo le hace si se siente el cambio también me ayudó con los AH

 

[renateves]

32% is fairly low, it's probably a genuine DTC once it hits a certain threshold

Whell... it looks like I just tricked him! For now!
The trick was to put a realistic number:
SOH: 65%
Hx: 55%

Today, no DTCs appear and after road test and garage final test to extract to the bottom, i finally could see the degradation on the battery:


Until to this moment, no error appear again. So the update\crack was success! (finger cross)
Tomorrow is another day

 

[renateves]

This does not magicaly fix your battery. This work guys are doing is for posibility to adjust BMS for projects and upgraded cells.

Yes i know. I'm not a beginner... if I'm lazy, i will not run a marathon... but, in this case, from my test and reading LSpy, i was sure that this BMS was confused (or lazy)!
There for my test of today, that for now confirm my suspicions. I was extracting energy when SOC was 0% and voltage around 3.4v to 3.6v.

 

[ginetto]

Yes i know. I'm not a beginner... if I'm lazy, i will not run a marathon... but, in this case, from my test and reading LSpy, i was sure that this BMS was confused (or lazy)!
There for my test of today, that for now confirm my suspicions. I was extracting energy when SOC was 0% and voltage around 3.4v to 3.6v.

this is almost out of thread but a staticimage of the battery do not give you the presence of weak cells that could drop voltage under load. So readin 3.4v (that is almost near 20% SOC) is useless if it is a read of the battery in quite state.

 

[safetyuggs]

A huge thanks to @Louis Ching! He very kindly donated two ZE0 and a ZE1 BMS. I'll pay another $85 to Nissan for another day's 'subscription' - hopefully for the last time. I'll post my code changes to my firmware here in a bit if anyone with a bit of C experience wants to verify my code is doing what I think it is before I flash it.

 

[safetyuggs]

The updated 21 PID:




There are a few other simple changes to the code, all pid21 functions expect 2 byte commands and will return if not exactly two, I've changed that to return if 5 or greater to allow commands like 0x04 21 82 00 00 where the last two values are the read address offset. Checksums are still checked but if not matched, the code continues execution. As long as I haven't missed anthing, this code should execute... Fingers crossed

 

[explorer232]

Checksum is correctly cracked and other you can adjust even later