Reverse engineering BMS Firmware / Reflashing BMS

My Nissan Leaf Forum

Help Support My Nissan Leaf Forum:

This site may earn a commission from merchant affiliate links, including eBay, Amazon, and others.
First test drive on the new firmware.

First thing I noticed is the increased acceleration. By a noticable amount. I wonder why the Yaste bridge limits available KW? With Yaste it'll jump up to 80kw but will quickly fall to around 60kw, not the case with the bridge removed.
Yaste limits the power because the cells can not take the full 80kW. @safetyuggs please prioritize getting this power limit back.

For example, these Chinese sellers don't mention that the 24-53kWh packs are limited to 80A-150A but only the 63kWh pack is capable of 200A. Which is something we found out during testing. That means only AZE0s with the stock motor can go for these upgrades and ZE1s should never go for this upgrade.

Without this you will damage the battery and cause a thermal event
 
I drove 4hrs on the Can Bridge yesterday, and it will allow the full 80kw too, It just takes longer to 'ramp up' to 80kw. With the yaste 63kwh cells, 80kw is only 1C so I don't think this will cause a thermal event. We can charge at 60kw for an hour with only 3-4deg c rise in temp.

The 100km drive back from the beach has ~45kms of uphill which consistently draws 60kw, often higher.

I'll find the tables which limit the available power for those that use the smaller cells. I'm over 5000km in on my kit and so car, the cells have performed great! It's just the can bridge that is full of bugs, locks up the can bus (You can see the dash occasionally freeze, instantanious power will lock up and show the last known value, even when full regen), leafspy doesn't work with it plugged in, SOC doesn't work on the dash unless you fully charge on AC to 100%.
 
I think its the delay to reach 80kw which makes it feel like it has less acceleration on the yaste bridge, vs the instant max when you put your foot down. I'm suspecting it's not a limit in the bridge, more so the bridge locking up or congesting the can bus with nonsense which delays vital communications. There's definitely something wrong happening in that bridge...
 
Yaste limits the power because the cells can not take the full 80kW. @safetyuggs please prioritize getting this power limit back.

For example, these Chinese sellers don't mention that the 24-53kWh packs are limited to 80A-150A but only the 63kWh pack is capable of 200A. Which is something we found out during testing. That means only AZE0s with the stock motor can go for these upgrades and ZE1s should never go for this upgrade.

Without this you will damage the battery and cause a thermal event
From 24 kWh bms firmware I have extracted table (max_current_limit) and for stock cells current limit is too high compare to these catl cells.
 

Attachments

  • discharge.png
    discharge.png
    52.5 KB
I believe the numbers are scaled before they're sent over can? I'll check the logs to confirm. If you're using my patched firmware you can read any memory address over can so you can see what is being calculated, and what is being sent
 
3NA0A -24 кВт/год (без батареї обігрівача)
3NA1A - 24 кВт (обігрівач від батареї)
9RB3A - 24 кВт ( 2015 м/р )
4NP2A - 24 кВт ( 2016 м/р )
4NP4A - 30 кВт (стара версія)
4NP4C - 30 кВт (нова версія)
5SA2B - 40 кВт
6SH1A - 62 kWt

6WX2A - 40 кВт e-NV 200

3NA0A/3NA0C -24 kWh ZE0(without heater battery)
3NA1A/3NA1B - 24 kW ZE0(battery heater)
3NF1A - 24 kW AZE0
9RB3A - 24 kW ( 2015 m/y )
4NP2A - 24 kW ( 2016 m/y )
4NP4A - 30 kW (old version)
4NP4C - 30 kW (new version)
5SA2B/5SH2D - 40 kW
6SH1A - 62 kWt



4FA2B - 24 kWh e-NV 200 (without heater)
6WX2A - 40 kW e-NV 200
 
3NA0A/3NA0C -24 kWh ZE0(without heater battery)
3NA1A/3NA1B - 24 kW ZE0(battery heater)
3NF1A - 24 kW AZE0
9RB3A - 24 kW ( 2015 m/y )
4NP2A - 24 kW ( 2016 m/y )
4NP4A - 30 kW (old version)
4NP4C - 30 kW (new version)
5SA2B/5SH2D - 40 kW
6SH1A - 62 kWt



4FA2B - 24 kWh e-NV 200 (without heater)
6WX2A - 40 kW e-NV 200
3NF1A=Brake?
My nissan Leaf tekna 24kwh 2013:
 

Attachments

  • IMG_4190.jpeg
    IMG_4190.jpeg
    1.4 MB
OK so this is why the Yaste can bridge breaks leafspy compatibility and locks up the Leaf's can bus.

These are recurring messages that should be sent from the BMS (or bridge) every 500mS.

The Yaste bridge is sending them back to back, non stop, flooding the EV CAN bus, and not allowing any other messages to get through.

This is why CAN messages freeze, or don't get updated - they just rarely get a break in the traffic to send messages.
 

Attachments

  • Capture.PNG
    Capture.PNG
    110 KB
I've updated the GID code and it now reports accurate remaining gids and max gids and the dash GOM seems to be right on the mark.

For dash SOC bars, I'm thinking of using the % of available gids vs max gids.

Can anyone think of a reason this wouldn't be suitable?

Right now it uses a lookup table of 16bit values to determine the number of bars, but I'm not too sure what these values represent. I'll keep digging into the code to see where these values come from, and I'll log the memory values during charging to try find some kind of relationship.
 
in my ZE0, dash bars are controlled via BMS, can message 5BC. If you have a USB-Can device, you can send any bars value you like, 0-11 to temp, soc or soh. The 5BC frame is multiplexed so if Byte4, bit0 is cleared, the lower nibble in Byte 2 is Capacity bars, if bit0 is set, it is SOH bars.

GOM is generated by the VCM, bars are not.
 
yes, this is what the BMS will send whenever it is powered up:

1737619961212.png

This is from my BMS on my bench.

The two comms address for the BMS is 79B (to talk to the BMS) and it replies on 7BB.

5BC is sent every 500mS (twice a second), 1DB, 1DC and 55B are sent every 100mS (10 times a second)
 
Leaf BMS flasher App for Tactrix Openport2.0 (clone) - Note this is currently only suitable for 3NA0x ECU's as it writes 3NA0D as the firmware label. I'll correct this at a later data for other BMS variants.
Hi. Do we need direct EV CanBus connection or it is going in standart CanBus over VCU?
I have Scanmatic tool that supports direct pass thru J2534.
 
what error are you getting?

You'll need msvc runtime pack if you get msvc......dll errors?
Yes, I got many msvcxxx.dll errors, installed runtime packs etc, and no app is just not starting without any errors. i believe i will need to make clean Win install :)
I did try "Latest Microsoft Visual C++ Redistributable Version", but after that still got .dll errors. Then I did collect separete .dlls
 
Back
Top