Reverse engineering BMS Firmware / Reflashing BMS

My Nissan Leaf Forum

Help Support My Nissan Leaf Forum:

This site may earn a commission from merchant affiliate links, including eBay, Amazon, and others.
You rock mate!

Waiting for the android app so we can use leafspy adapters to flash.
Would this also fix the 4bar issue from the leafBMSTool ?
Using a elm device (like you use for leafspy) would take around 90min to reflash.

I'm still working on the 4bar issue. A firmware update can fix that but not updating would be the better solution
 
I wrote about this problem in that thread. You just need to directly connect your OBD adapter directly to the CAN line of the BMS.
https://mynissanleaf.com/threads/android-app-to-view-reset-soh-hx-lx-cx-etc.36841/post-654290
Does it mean i have to prob the HV battery's canbus pins on its socket? is there an easier way to access the CH-CL wires inside the car ?

Using a elm device (like you use for leafspy) would take around 90min to reflash.

I'm still working on the 4bar issue. A firmware update can fix that but not updating would be the better solution
yeah, 4bar issue is not a big deal but It would be great to be able to flash BMS with using ELMdevice to change the kWh limit. 90min is not a very long time tho.
 
I'll pm you a link in the morning, it's late here. I ordered the one that said it was ok to be online with. Pretty sure they're all the same though. Key point is to never use the official software or drivers or it'll instantly brick your device.
 
I'll pm you a link in the morning, it's late here. I ordered the one that said it was ok to be online with. Pretty sure they're all the same though. Key point is to never use the official software or drivers or it'll instantly brick your device.
Ohh i see what you mean.
I also sent you a PM.
 
Does it mean i have to prob the HV battery's canbus pins on its socket? is there an easier way to access the CH-CL wires inside the car ?
You just need to connect your ELM adapter to the EV bus in your OBD connector

ELM327 Connection Scheme for EV-CAN:
Pin 12 (CAN-H) → ELM327 CAN-H
Pin 13 (CAN-L) → ELM327 CAN-L
Pin 16 (12 V) → ELM327 VCC (Power)
Pin 4 or 5 (GND) → ELM327 GND

After that, you should reset the SOH again.
 
You just need to connect your ELM adapter to the EV bus in your OBD connector

ELM327 Connection Scheme for EV-CAN:
Pin 12 (CAN-H) → ELM327 CAN-H
Pin 13 (CAN-L) → ELM327 CAN-L
Pin 16 (12 V) → ELM327 VCC (Power)
Pin 4 or 5 (GND) → ELM327 GND

After that, you should reset the SOH again.
Didnt work for me AZE0. i did connect to EVbus and resetting soh didnt repair 4 bars.
 
I'll check, also, i've said this multiple times in this thread but my custom firmware is for one specific BMS only, flashing to any other will likely brick it.
That's okay. For my project, being able to dischage the extender battery trough current sensor is not essential. The current sensor in old leaf battery is so bad. i guess that's why new leaf models are using 2 hall effect current sensor that is calibrated for different range of currents.
I assume this is why old leaf users experience SOH increase when they do quick charging. Because the sensor is counting amperes wrong. Especially at cold weathers hall sensors tend to output higher analogue voltage difference. Seems like calibration and temp compensations are all over the place.
I am a new leaf owner so excuse me if i am asking dumb questions 😅

How do i know that i have the same BMS version with your firmware is cooked for.
1738224489777.jpeg
This is the SS after i attempted to reset BMS SOH.
 
I have Tactrix Openport 2.0 J2534, is there any way to use it to download firmware from my BMS or is it even possible? The official Nissan Consult 3 does not allow downloading firmware. Maybe you can read it using Ecuflash 1.44 which comes with the cable but you need an xml definition file for Leaf, maybe someone has one? Maybe someone can suggest other options? If we had the opportunity to save our initial firmware version, it would give us more opportunities for experiments, as well as to return to the initial state in case of failure.
 
I have Tactrix Openport 2.0 J2534, is there any way to use it to download firmware from my BMS or is it even possible? The official Nissan Consult 3 does not allow downloading firmware. Maybe you can read it using Ecuflash 1.44 which comes with the cable but you need an xml definition file for Leaf, maybe someone has one? Maybe someone can suggest other options? If we had the opportunity to save our initial firmware version, it would give us more opportunities for experiments, as well as to return to the initial state in case of failure.
You can read through the thread for the exact answer and information, if you don't want to, the short answer is:

You can download the firmware for most BMS from Nissan-Tech website for USD$50 ea. Not all firmwares are available
You cannot dump the firmware from a BMS via CAN.
You can extract the firmware by disabling read protection, this takes between 90-180 hours on average for a single firmware. It requires custom hardware.
You may be able to use a miniprog to extract the firmware in ~30 seconds. This hasn't been tested but we know the BMS's password to enable read protection.
 
That's okay. For my project, being able to dischage the extender battery trough current sensor is not essential. The current sensor in old leaf battery is so bad. i guess that's why new leaf models are using 2 hall effect current sensor that is calibrated for different range of currents.
I assume this is why old leaf users experience SOH increase when they do quick charging. Because the sensor is counting amperes wrong. Especially at cold weathers hall sensors tend to output higher analogue voltage difference. Seems like calibration and temp compensations are all over the place.
I am a new leaf owner so excuse me if i am asking dumb questions 😅

How do i know that i have the same BMS version with your firmware is cooked for.
View attachment 6743
This is the SS after i attempted to reset BMS SOH.
I'm not sure if that is the reason they changed current sensor design, more likely due to the much higher discharge current on post Gen1 leafs, using two sensors will give more accurate readings across the entire range.
 
Back
Top