LEAF CANbus decoding. (Open discussion)

My Nissan Leaf Forum

Help Support My Nissan Leaf Forum:

This site may earn a commission from merchant affiliate links, including eBay, Amazon, and others.
More good info, thanks Dala. I am away from home at the moment but am doing two things while away:
1- rewriting my code to include the MPRUN/CSUM/CRC as described in your video. This will certainly change some of the outcomes I am getting and explains a lot about my lack of success on the OBC/charger project, I will be revisting that shortly I hope to. The more I think about it the more significant this information is.
2- Writing a new piece of code to run on a stand alone UNO and an MCP2515 that emulates a Nissan Leaf or at least the BMS relevant VCM & OBC communication. This will help reduce the code development time by not having to connect to the car until the code is really ready ;) and advance the OBC charger project.
More to follow, Thanks again.
 
Dala, As I am coding my leaf emulator I notice that byte 4 of 5BC has different lengths associated with signals 2, 5 and 9 creating bit overlaps. I may just only use 2 permutation of this command for my first version as the information in bytes 5,6 & 7 are not critical for reading GIDS. Signal 5 bit 0 would appear to be the multiplex for charge and capacity bars and bits 3 2,1 being part of signal 4. Signal 9 is perhaps not relevant, other than bit 0 as noted above. Any comments ?
With thanks
Peter.
 
49thdiver said:
Dala, As I am coding my leaf emulator I notice that byte 4 of 5BC has different lengths associated with signals 2, 5 and 9 creating bit overlaps. I may just only use 2 permutation of this command for my first version as the information in bytes 5,6 & 7 are not critical for reading GIDS. Signal 5 bit 0 would appear to be the multiplex for charge and capacity bars and bits 3 2,1 being part of signal 4. Signal 9 is perhaps not relevant, other than bit 0 as noted above. Any comments ?
With thanks
Peter.

Shouldn't affect GIDs reading. Just alternate something like this
5x
0x000005bc 8 0x4c 00 98 64 be 03 ff ff
5x
0x000005bc 8 0x4c 00 f0 64 bf 03 ff ff
....
 
damienmaguire posted some raw CAN logs from a ZE1 "gen3" inverter. This helps decode the CAN-messages on EV-CAN for ZE1 even further
https://github.com/damienmaguire/Nissan-Leaf-Inverter-Controller/blob/master/Gen3/CAN_Logs/inv_onown_from_cold.csv

https://github.com/dalathegreat/leaf_can_bus_messages/commit/daf8173dcd9db4f94fce3c7064713ec293c67769
 
Hi,

Thank you very much for this thread, Im learning a lot about my new leaf.

I've bought a 2020 model (ZE1), and Im triying to make an application to connect a OBD plug with my phone and read some battery data. I know that the OBD is locked, and I need to query. I've tried to query with 79B messages that I found in https://docs.google.com/spreadsheets/d/1EHa4R85BttuY4JZ-EnssH4YZddpsDVu6rUFm0P7ouwg/edit#gid=7 . With these querys I receive data, but I cant decode most of them, like the SOC, that I think it should be trivial. Somebody knows how can I get these parameter?
 
nickonck said:
Hi,

Thank you very much for this thread, Im learning a lot about my new leaf.

I've bought a 2020 model (ZE1), and Im triying to make an application to connect a OBD plug with my phone and read some battery data. I know that the OBD is locked, and I need to query. I've tried to query with 79B messages that I found in https://docs.google.com/spreadsheets/d/1EHa4R85BttuY4JZ-EnssH4YZddpsDVu6rUFm0P7ouwg/edit#gid=7 . With these querys I receive data, but I cant decode most of them, like the SOC, that I think it should be trivial. Somebody knows how can I get these parameter?

Hi, yes here is how:

Query to LBC:
0x79B 02 21 01 00 00 00 00 00
0x79B 30 00 00 00 00 00 00 00
Answer from LBC:
0x7BB 10 35 61 01 FF FF FC 18
0x7BB 21 02 AF FF FF FB 62 FF
0x7BB 22 FF F0 DD 0B 1C 30 D4
0x7BB 23 95 1D 33 06 03 95 00
0x7BB 24 01 70 00 26 9A 00 0C
0x7BB 25 44 B5 00 11 0B B8 80
0x7BB 26 00 01 FF FF FB 62 FF
0x7BB 27 FF FC AA 01 AD FF FF

Name: SOC (%)
Type: Integer
Description: State of Charge (SOC) of the HV Battery
Formula:
0x7BB 24 01 70 00 26 9A 00 0C
0x7BB 25 44 B5 00 11 0B B8 80
SOC = (data 24[7] << 16 | ((data 25[1] << 8) | data 25[2]))/10000
 
* LEAF 2018 CAN MESSAGES *

Hi all, after months of CAN analyzing, I guess it's time to release all my findings on the Leaf 2018 (+?) CAN messages.
I summarized them all in the PDF here: https://drive.google.com/file/d/1jH9cgm5v23qnqVnmZN3p4TvdaokWKPjM/view?usp=sharing
There you can find every variable found, with the description taken from SpyLeaf's documentation.
I also reported the function to convert the raw Temperature to °C and the function to get the values of the shunts.

In addition some open challenges:

// Left Arrow & Right Arrow
- The PDF lacks of a Arrows bytes combination I found two days ago such as:
Wiper == '0xb' & Light1 == '0x4' => Left_Arrow
Wiper == '0xb' & Light1 == '0x8' => Right_Arrow

// HVAC
- I couldn't find any messages related to the HVAC air flow modes and air recycle even if I guess they shall be trivial messages. I expect modes are corresponding to a byte that changes from X to X+5 while the air recycle shall be a bit 0/1 for recycle ON/OFF.

- HeaterTemp is still buggy. We detected that byte changes in according to the temp button pressure, but its values change from time to time. Using a static function to convert value to Temperature doesn't work every time.

// Recharging BMS messages
- We wanted to get recharge BMS values (HV_Current and OBC_Power) values, but apparently monitoring CAN messages once the power plug is attached is not trivial.
The can0 is answering for 4/5 minutes then it turns off and I can't get any messages.
From recent tests, I found that this is not always true:
continuing sending Power_Software and PlugState queries seem to wake the CAN up again.
From time to time the bus, instead of not replying, it replies with PlugState = 2 and I can ask for G1 BMS messages, getting all HV_Current values I need even if the car is OFF and the doors are closed.
I hope someone can suggest a clever way to keep the CAN open without bombing it with queries :D
 
One of the big reasons that's happening, is because the debug mode messages are not meant to be repeated. The official documentation even says the car should not be operated or charged during a CONSULT session, which is the only moment debug messages are requested. This is also one of the reasons there are extremely rare instances of the car getting into a fault state when driving with leaf spy.

For live or everyday logging/messaging I highly recommend just using the regular CAN bus messages and not trying to send debugging and engineering messages.
 
Hi Mux, could you address me to the official documentation you're talking about?
We've just tested that polling the CAN bus while the car is off, it actually discharges the 12V battery.

Is there some info about accessing the regular CAN bus?
Tnks
 
That would be the CONSULT documentation, which ultimately is the only way - without leaf spy or other tools - that the car would encounter these messages. I'm not sure I can share that documentation without some repercussions for my consult license.

And yes, you'll run into 12V drain issues if you do this, that's a well-known issue with leaf spy as well.

What would you like to know about the CAN bus? There's an entire CAN reverse engineering topic here: https://www.mynissanleaf.com/viewtopic.php?f=44&t=4131
 
Hi mux, yes now We're aware about the 12V battery power drain and we're thinking how to stop the OBD2 platform to query the CANbus while it's not necessary, shutting it down.

Btw, I'm well aware about this thread and I read it all, but you shall also know that 2018+ Leaf info are missing since the gateway added with 2018 model.
You're suggesting to connect to the regular CAN bus instead of the OBD2 port, but I haven't found any wiring information about how 2018+ are working now. OLD models shared different buses on other OBD pins (EVCan, QCcan, CARcan etc) but this apparently isn't true anymore.
So querying the gateway with 7XX IDs seems the only way to get Leaf's variables.
 
gorgo said:
Hi mux, yes now We're aware about the 12V battery power drain and we're thinking how to stop the OBD2 platform to query the CANbus while it's not necessary, shutting it down.

Btw, I'm well aware about this thread and I read it all, but you shall also know that 2018+ Leaf info are missing since the gateway added with 2018 model.
You're suggesting to connect to the regular CAN bus instead of the OBD2 port, but I haven't found any wiring information about how 2018+ are working now. OLD models shared different buses on other OBD pins (EVCan, QCcan, CARcan etc) but this apparently isn't true anymore.
So querying the gateway with 7XX IDs seems the only way to get Leaf's variables.

Typical for most all late ICEVs with many ECUs with multiple CANs, i.e. a central gateway ECU from the OBDII connector.
 
lorenfb said:
Typical for most all late ICEVs with many ECUs with multiple CANs, i.e. a central gateway ECU from the OBDII connector.

Exactly, so I guess the only access is by querying the gateway or get single bus data behind the gateway, but I don't even know where to start checking those wires without taking the dashboard apart.
 
gorgo said:
Hi mux, yes now We're aware about the 12V battery power drain and we're thinking how to stop the OBD2 platform to query the CANbus while it's not necessary, shutting it down.

Btw, I'm well aware about this thread and I read it all, but you shall also know that 2018+ Leaf info are missing since the gateway added with 2018 model.
You're suggesting to connect to the regular CAN bus instead of the OBD2 port, but I haven't found any wiring information about how 2018+ are working now. OLD models shared different buses on other OBD pins (EVCan, QCcan, CARcan etc) but this apparently isn't true anymore.
So querying the gateway with 7XX IDs seems the only way to get Leaf's variables.

EV-CAN is located in the same place on ZE1 as on AZE0. Check this video for where to find it https://youtu.be/eLcNSo2Vn6U?t=78
 
Did some CAN manipulation last night with my battery upgraded LEAF. Was kinda funny to see what the QC station did when SOC% went down during charge 😂

https://youtu.be/5Kts6c3ws40
 
Hi all,

If I've got the following canbus message (captured from OVMS):


Code:
1628110867.143809 2R11 215 ff f0 ff 00 ff ff

Am I right in thinking that this is indicating my AC compressor is on? (as per the canmsgs.xlsx SS - PID is 215 _i think_ and byte 'B' is F0

I'm first of all checking if I have that correct - and also to check - I don't think I should see that when the car is off?
 
Hello, guys any updates on how to update the SOC. Any other solutions other than reload the BMS with the +12
 
nlspace said:
mafify said:
Any other solutions other than reload the BMS with the +12

Why would anyone want to do this--not honest.

I am trying to get reading for the battery alone, not connected to vehicle and as stated in the discussion thread, SOC doesn't update by itself. I need to turn the +IGN and +12 off and on to recalculate the SOC. I was just wondering if anyone figured out what is the heartbeat msg that the back take to keep alive and keep updating SOC
 
Back
Top