Controlling the Leaf Inverter on its own

[celeron55]

Continued from the two pages of posts starting from here: http://www.mynissanleaf.com/viewtopic.p ... 57#p513157

I've been trying to get any responses to any diagnostic messages from the inverter with no luck. It doesn't respond to, say, 784: 03 19 02 0B 00 00 00 00, or anything thereabouts that I've tried. (That message appears to be Leaf Spy Pro's best attempt, if I'm not mistaken. @Turbo3: Can you confirm? I'm lacking anything working to compare to so I can't tell where my problems are!)

On its own on the bus, with CAN ACKs being replied by another device, the only thing the inverter keeps doing is outputting 1DA every 10ms and 55A every 100ms. It also responds with CAN ACKs to anything I put on the bus.

It could be that the inverter wants to hear a response to 1DA or 55A from the VCM before it will do anything else. Or it could be waiting for something else, even something diagnostics related that the VCM would send before passing other commands.

The 55A messages exactly loop through this:

Code: Select all

55A: AE 3E 3F 00 5F 00 82 B0
55A: AB 3E 3F 00 5F 00 82 B0
55A: 1D 3E 3F 00 5F 00 82 B0
55A: 1C 3D 3F 00 5F 00 82 B0
55A: 13 3E 3F 00 5F 00 82 B0

The 1DA messages don't form a perfect loop, but D6 loops through 0xE0...E3 and D0:1 is just a voltage measurement:

Code: Select all

1DA: 01 40 00 00 00 00 E0 E9
1DA: 01 00 00 00 00 00 E1 CE
1DA: 01 00 00 00 00 00 E2 C4
1DA: 00 40 00 00 00 00 E3 E4

EDIT: In @carrott's capture, D6 loops through 0...3, so the 3 MSbs differ here. Maybe they're status flags of some kind. Also, towards the end of the capture, when the first voltage byte D0 has dropped to 0x10 (which is around 32V I think), D6 becomes 0x80 based.

1DA and 55A combined roughly repeat through a 5 second loop like this, and this is all I've been able to see on the bus from the inverter so far. I have not recorded responses to any playbacks of captures yet.

Code: Select all

1DA: 00 40 00 00 00 00 E3 E4
1DA: 01 40 00 00 00 00 E0 E9
1DA: 01 00 00 00 00 00 E1 CE
1DA: 01 00 00 00 00 00 E2 C4
1DA: 00 40 00 00 00 00 E3 E4
1DA: 01 40 00 00 00 00 E0 E9
1DA: 01 00 00 00 00 00 E1 CE
1DA: 01 00 00 00 00 00 E2 C4
1DA: 01 40 00 00 00 00 E3 E3
1DA: 00 40 00 00 00 00 E0 EE
55A: 1D 3E 3F 00 5F 00 82 B0
1DA: 00 00 00 00 00 00 E1 C9
1DA: 00 00 00 00 00 00 E2 C3
1DA: 01 40 00 00 00 00 E3 E3
1DA: 01 40 00 00 00 00 E0 E9
1DA: 00 00 00 00 00 00 E1 C9
1DA: 00 00 00 00 00 00 E2 C3
1DA: 01 40 00 00 00 00 E3 E3
1DA: 01 40 00 00 00 00 E0 E9
1DA: 01 00 00 00 00 00 E1 CE
1DA: 01 00 00 00 00 00 E2 C4
55A: 1C 3E 3F 00 5F 00 82 B0
1DA: 01 40 00 00 00 00 E3 E3
1DA: 00 40 00 00 00 00 E0 EE
1DA: 01 00 00 00 00 00 E1 CE
1DA: 01 00 00 00 00 00 E2 C4
1DA: 01 40 00 00 00 00 E3 E3
1DA: 01 40 00 00 00 00 E0 E9
1DA: 01 00 00 00 00 00 E1 CE
1DA: 00 00 00 00 00 00 E2 C3
1DA: 00 40 00 00 00 00 E3 E4
1DA: 01 40 00 00 00 00 E0 E9
55A: 13 3E 3F 00 5F 00 82 B0
1DA: 01 00 00 00 00 00 E1 CE
1DA: 00 00 00 00 00 00 E2 C3
1DA: 00 40 00 00 00 00 E3 E4
1DA: 01 40 00 00 00 00 E0 E9
1DA: 00 00 00 00 00 00 E1 C9
1DA: 00 00 00 00 00 00 E2 C3
1DA: 00 40 00 00 00 00 E3 E4
1DA: 00 40 00 00 00 00 E0 EE
1DA: 00 00 00 00 00 00 E1 C9
1DA: 01 00 00 00 00 00 E2 C4
55A: AE 3E 3F 00 5F 00 82 B0
1DA: 01 40 00 00 00 00 E3 E3
1DA: 00 40 00 00 00 00 E0 EE
1DA: 01 00 00 00 00 00 E1 CE
1DA: 01 00 00 00 00 00 E2 C4
1DA: 01 40 00 00 00 00 E3 E3
1DA: 00 40 00 00 00 00 E0 EE
1DA: 01 00 00 00 00 00 E1 CE
1DA: 00 00 00 00 00 00 E2 C3
1DA: 01 40 00 00 00 00 E3 E3
1DA: 01 40 00 00 00 00 E0 E9
55A: AB 3E 3F 00 5F 00 82 B0

[JeremyW]

For the 2011's and 2012's, 55A contains temperatures for the motor and inverter. Everything below is from observed 2011/2012 behavior:

We never observed byte 0 having any other value than 00, so that might be status flags.
Byte 1 contains temperature of the communications board at 0.5 degrees C per bit
Byte 2 might contain temperature of the IGBTs at 0.5 degrees C per bit
Byte 3 is 00 at all times
Byte 4 might be the IGBT driver board temperature at 0.5 degrees C per bit
Byte 5 is the motor temperature at 0.5 degrees C per bit
Byte 6 is probably CRC
Byte 7 is a counter that on our cars went 08,28,48,c8. My guess is this would increment similarly if you sent the right VCM can messages

Looks like your board might be running at 31C, igbt driver board is 31.5C, motor is disconnected or quite hot (47.5C?)

Overall, I think 55A can be treated as a status message.

I thought message 11A might come from the inverter. I wonder if it will pop up if you get it to a happier state? I observed it only while driving, so it might show up when the inverter is active.

I'm assuming you have this google doc spreadsheet, correct?
This is the sheet I worked off of when I had a Leaf

[celeron55]

I'm thinking 11A could be shift position signal from the VCM, or something similar.

[JeremyW]

Could be. Looking through the service manuals for the 2012 and the 2013s, it looks like the shifter control functionality moved from a separate module (on the can bus) to internal to the VCM. Let’s assume that 11A is the shift module for the 2011/2012s... you might have a differnent format for your 11A message vs our old assumptions. You might also not have message 284 on the bus, as that was used by the shift controller.

One thing I would do is look at message timing in your logs of a functioning leaf. It’s fairly common to see groups of messages come out together on the bus from one module. For the 10ms messages from the VCM, it may be that 11A along with maybe 1F2 are sent (nearly) together.

[celeron55]

You can check the more recent 11A format from carrott's logs.

carrott's logs are not very useful for the timing purpose, as their time resolution is like 30ms - even messages known to be sent at 10ms intervals are grouped together at the same exact time.

I do have 2011-2012 logs with precise timestamps and have used it in this way. Actually, they're on github: https://github.com/damienmaguire/LeafLogs (these logs actually have an attached video too, it's super boring but sometimes useful - "avke2FzvvpY" on youtube)

Ideally, right now, I'd like to have a capture of the EV bus with the VCM unplugged (I think it terminates the bus, so add 120 ohms in place of it), of Leaf Spy Pro trying to read DTCs from the inverter, and then if the scan does not succeed, a capture of the scan with the VCM plugged in. I can't really proceed without having the ability to read and clear DTCs.

[celeron55]

Meanwhile, I read the EEPROM again.

This is the original content, now in xxd-friendly format: https://gist.github.com/celeron55/e052f ... 2838cb1235

This is the current content: https://gist.github.com/celeron55/71924 ... 06f6c2b94a

You can find for example the values 3193 and 3197 in there.

The DTCs P3193 and P3197 mean the inverter was unable to receive BMS and VCM CAN signal - so yes, now I do have the bare minimum means to read and clear DTCs! No diagnostic protocol needed!

This is kind of nuts but I'm happy. I can slowly iterate forward now.

EDIT:

Looks like it originally had:
- P0A8D: 12V under voltage, and
- P3247: "Driver circuit power does not come ON when starting EV system"

Now it has:
- P0A1B: "A malfunction is detected in the traction motor inverter (motor controller)"
- P318E: "Traction motor inverter is unable to receive the EV system CAN signal from VCM"
- U1000: "CAN communications signals continuously for 2 seconds or more cannot be transmitted"
- P3193: "Traction motor inverter is unable to receive the EV system CAN signal from Li-ion battery controller continuously for 2 seconds or more", and
- P3197: "Traction motor inverter is unable to receive the EV system CAN signal from VCM (Electric shift control module) continuously for 2 seconds or more"

Makes enough sense to me.

[celeron55]

I got the inverter to respond to DTC requests! It works exactly the way Leaf Spy Pro attempts to do it and does not require anything special.

Was just a matter of messing up one of the many moving parts in these protocols... (well, I messed up the ISO-TP/CAN-TP framing of the UDS protocol. For short.)

EDIT: DTC reading is working now. I basically wrote my own ELM327 clone, but... it does work, beautifully!

[carrott]

- P318E: "Traction motor inverter is unable to receive the EV system CAN signal from VCM"
- P3193: "Traction motor inverter is unable to receive the EV system CAN signal from Li-ion battery controller continuously for 2 seconds or more", and
- P3197: "Traction motor inverter is unable to receive the EV system CAN signal from VCM (Electric shift control module) continuously for 2 seconds or more"

What happens if you filter out the inverter messages from my capture and then play the rest of the car back to the inverter? I'd expect these faults to go away and be replaced with new ones related to the start up sequence.

I once played a recording of the EV bus back into a running car, that made it very upset and I had to disconnect the 12v battery to make it work again.

Do you have a motor connected, it doesn't look like it in the photo. Be careful with playing my capture with a connected motor as I take the car for a short drive which, if everything worked in your setup, would accelerate your motor and maybe make it roll around on the floor.

- U1000: "CAN communications signals continuously for 2 seconds or more cannot be transmitted"

Is any node on your bus acking the can messages? If nothing acks them then the inverter will notice that nothing received it's messages which might cause this fault.

[celeron55]

What happens if you filter out the inverter messages from my capture and then play the rest of the car back to the inverter? I'd expect these faults to go away and be replaced with new ones related to the start up sequence.

That's what I'm going to start doing once I'm comfortable with trying it.

Do you have a motor connected, it doesn't look like it in the photo. Be careful with playing my capture with a connected motor as I take the car for a short drive which, if everything worked in your setup, would accelerate your motor and maybe make it roll around on the floor.

In that photo I had the inverter open and disconnected from the motor, as I was playing with the EEPROM. Now it's sitting back on top of the motor with everything connected.

I'll only connect it to the mains with a 2A fuse (and a rather small isolation transformer) at maximum for now. That's not enough power to make it roll around the room, it'll just blow the fuse. My biggest worry is regen blowing up the capacitors and IGBTs with over voltage, but the TMS manual seems to be saying the inverter will protect itself once the voltage goes past 500V.

- U1000: "CAN communications signals continuously for 2 seconds or more cannot be transmitted"

Is any node on your bus acking the can messages? If nothing acks them then the inverter will notice that nothing received it's messages which might cause this fault.

U1000 is a generic CAN code, I think it pops up under any CAN-related issue in addition to the specific issue. If I don't have anything to provide CAN ACKs on the bus, the inverter won't even get to 55A; it just spams the first message as-is until something ACKs it.

My list of codes now that the inverter is attached to the motor and DTCs cleared is:

P318E
P3193
P3197
U1000

Which is, only CAN codes for not hearing messages from other modules. This is a good start.

[jbpalm]

Great work, Celeron55. We are doing similar work with a Leaf motor/inverter on the bench.

From the "leaf canbus decoding" thread, their compiled spreadsheet suggests the 1DA output from the inverter is inverter input voltage. Our tests using very low voltage inputs from 0 to 80 volts resolved the zero (left hand) byte of 1DA being the inverter voltage devided by 2. For instance the following voltages showed hex and decimal values as follows:

80v -> hex 28 = dec 40
40v -> hex 14 = dec 20
20v -> hex 0B = dec 11

We would like to hear more about your results:
Please share how you are resolving the DTC descriptions shown on your screen.
What method did you use to clear the DTCs?
Have you discovered a needed list of canbus startup messages?

We are compiling data from a running 2013 Leaf on a lift, and building a set of commands for running our bench drivetrain. We will share what we find as it comes out.