Page 1 of 56

LEAF CANbus decoding. (Open discussion)

Posted: Mon May 30, 2011 2:57 pm
by GroundLoop
The CANbus network in the LEAF is the central nervous system, connecting all the major modules and relaying information between them. This thread is a place for like-minded hackers to share information on the LEAF's CANbus topology, message contents, experiments, and gleaned information from the car data systems.

The LEAF Service Manual (LAN section in particular) has thorough information regarding the connectivity, pinouts, and functional blocks on the CANbus. However, it does not describe the actual message packets. Specific diagnostics and operations are documented only for the CONSULT III+. By studying the CANbus directly, it is possible we can extract more information than the car displays to the user, and possibly perform some operations done by the CONSULT tool.


Data Link Connector
There are three CAN (Controller Area Network) network pairs brought out to the 16-pin DLC (Data Link Connector), labeled (M4) in the service manuals. This connector is located above the driver's left knee, and is sometimes referred to as an OBD or SAE J1962 connector. Be very careful about buying OBD "code scanner" products, as they generally use an unrelated OBD data bus (ISO 9141-2 "K-Line" or "L-Line") for low-speed communication, and are useless for monitoring the CAN bus.

This image shows the pinout of the female (car) connector:

Primary CAN Bus, "CAN communication circuit"
The primary CAN bus is on the standardized (J2284) connector pins, CAN-L (14) and CAN-H (6). Most off-the-shelf CAN car adapters will use this wire pair exclusively.

This bus carries traffic between the VCM, DLC, BCM, ABS, Steering, and Dash/Nav. It has most of the interior operations, displays, and controls.

EV CAN, "EV system CAN circuit"
The second bus is the "EV CAN". This is on Discretionary pins in the DLC: EV CAN-L (12), EV CAN-H (13).
This bus has communication including the VCM, HVBAT, OBC, and TCU.

Note that VCM is on both the CAN & EV-CAN busses and can gateway traffic between them. The chart on page LAN-33 has a detailed list of each signal, and which bus/module transmits/receives it.

Because the OBC, Motor, and HVBAT are on the EV CAN bus only, this has been the primary area of my interest. To connect to this bus, you will likely have to make your own J1962 cable, as it is not the 'default' CAN bus for diagnostic tools.

There is a third less-documented CAN bus between the Audio-Video Navigation unit and the "multifunction switch". (The multifunction switch is the physical button panel around the A/V screen.. Map, Eco, Menu, etc.)
AV-CAN-H (11)
AV-CAN-L (3)

CHAdeMO Quick Charge
The CHAdeMO DC quick charge port (on cars so equipped) has an additional CAN connection to the On Board Charger. Anyone know more about the pinout here?

Pin 16 has constant +12v DC power from the battery. It is protected by a 10A fuse #13.
Pin 8 has switched power when the Leaf is ON, protected by 10A fuse #3. This is a nonstandard pin assignment, and most commercial devices use the constant power found on Pin 16.

120 Watts is enough power to melt small-gauge wire, so an additional fuse is recommended for any DIY project.

Pin 4 is Chassis Ground, and Pin 5 is Signal Ground. Note that CAN is a differential bus, and has no need for a Ground reference. Indeed, if you can power externally, isolation is preferred. It appears that 4 & 5 are both wired to battery ground in the Leaf.

The TCU and Navigation unit are connected via USB 1.0. This is the link used to update Carwings information feeds, Charger location updates, etc. This data may not be on CANbus at all. (The TCU also has logic-level RS-232 available on its connector harness, apparently unused by the Leaf.)

Re: LEAF CANbus decoding. (Open discussion)

Posted: Mon May 30, 2011 3:10 pm
by GroundLoop
If you have an interest in hacking in this area, the Service Manual is a mandatory $20 ante, of course.

There are quite a few Internet primers on CAN-bus itself. ISO and SAE mandate certain behavior for OBD use, but the LEAF isn't necessarily subject to any of that. ISO11898-1 descirbes the physical link.

It's not a complicated LAN. Unfortunately, it has few consumer applications, so test equipment and adapters tend to be proprietary, esoteric, and expensive. Each bus is a differential pair of signals, and no ground is required for some (isolated) adapters. Unshielded twisted-pair wire is generally sufficient for connections. I use standard CAT5 ethernet, and have not used termination when plugging into the DLC.

Both of the CANbus networks operate at 500kbps. This isn't particularly demanding.
(From what I can tell, the Primary CAN is more 'saturated' with messages than the EV CAN.)
The EV CAN contents can (barely) fit into a 230kbps RS-232 stream, so some of the CAN-to-RS232 adapters may work.

The USB-connected adapters are preferred, since they tend to have 1Mbps+ bandwidth available.

Adapter examples are:
  • ValueCAN or NeoIV from Intrepid Systems
  • Acacetus CAN-uVCCM (limited to 56kbps! useless here)
  • Lawicel, both RS-232 and USB available

Re: LEAF CANbus decoding. (Open discussion)

Posted: Mon May 30, 2011 3:16 pm
by GroundLoop
The messages on the LEAF EV CAN bus seem to be all repeating/periodic... with 2, 10, or 100 repetitions per second.

The LEAF appears to use "standard" 11-bit CAN frames exclusively. (no 29-bit extended frames)
So the Identifiers could range from 0 to 0x7FF.
Along with the Identifier, the LEAF attaches one to eight bytes of payload data. (ie, "the meat")
I haven't seen any RTR transmissions (a special case), with ID and length but no data, but my equipment could be missing those altogether.

Putting the messages into groups, there are the highest-frequency ones, which appear every 10ms:

Code: Select all

ID 11A: 8 11800055400002CB 
ID 1D4: 8 F707000200066061 
ID 1DA: 8 0F000000000083AE 
ID 1DB: 8 0020C1EA00000080 
ID 1F2: 8 68646000003F0002 
This one message appears every 20ms:

Code: Select all

ID 284: 8 0000000000009319
These are every 100ms:

Code: Select all

ID 380: 8 0204202100000028 
ID 50A: 6 0601001F0000 
ID 50B: 6 000000000000 
ID 50C: 6 000000005DC8 
ID 54A: 8 3C00700F0000006E
ID 54B: 8 0008800004000001
ID 54C: 8 FFFF000000F8FF00
ID 54F: 8 420000000B800829
ID 55A: 8 005445005F4382F0
ID 55B: 8 C8C0AA00BAC0218B
ID 56E: 1 86
ID 5BF: 8 000000003800001B
And these are slower.. 500ms:

Code: Select all

ID 5B9: 5 585A60F028
ID 5BC: 8 3A812B3EC80620F0
ID 5C0: 8 C0787CF2C8D80000
And, that's really it.. these are all the messages on the EV BUS while driving.
Only 22 messages of 8 bytes or less. Further, we know most or all of the functions on the bus from the LAN chapter. As far as reverse-engineering goes, this isn't a long shot... or Legendary Difficulty.

Re: LEAF CANbus decoding. (Open discussion)

Posted: Mon May 30, 2011 3:16 pm
by turbo2ltr
All three buses are available on the port. I don't have the details handy but it's in the manual.

Re: LEAF CANbus decoding. (Open discussion)

Posted: Mon May 30, 2011 3:22 pm
by GroundLoop
turbo2ltr wrote:All three buses are available on the port. I don't have the details handy but it's in the manual.
Oh cool. What's the third bus?
I didn't check, but there might be a K-Line OBD on there.

Re: LEAF CANbus decoding. (Open discussion)

Posted: Mon May 30, 2011 3:51 pm
by sparky
OK. This is all cool and everything but what do we want to do with it?

More precision on SOC is a given. I'd like to get some battery balance info and be able to better monitor the comings and goings of coulombs over the next 3 years. Perhaps better charging control, but really I'm not often needing anything more than 80%. I'd like all this info logged on some device that I can query via WiFi when the LEAF is parked in my driveway.
So maybe two CAN interface chips tied to a Gumstix
I added a little CAN-bus card to this Arduino controller board I've had for awhile.
Logging EV and Car CANs to a laptop has been pretty straight forward. Packets are flying at up to 1 msec separation but I haven't had time to try and suss out the individual packet IDs. I probably only care about a handful of IDs anyway. The MBytes add up fast when driving a short time. I only need to listen for now but eventually we'll want to query the LEAF for specific stuff or to display SOC on a built in display.

Perhaps I can start to decode the relevant data but it would be nice if it's not all duplicated effort. Got EV-bus ID mapping?

Re: LEAF CANbus decoding. (Open discussion)

Posted: Mon May 30, 2011 4:57 pm
by turbo2ltr
theres a k line to the telematics (and possibly other systems)

There's also an AVCAN bus.

Re: LEAF CANbus decoding. (Open discussion)

Posted: Mon May 30, 2011 6:55 pm
by GroundLoop
turbo2ltr wrote:There's also an AVCAN bus.
Is that the one on DLC pins 11 & 3? That go to the Multi Function Switch?

Re: LEAF CANbus decoding. (Open discussion)

Posted: Mon May 30, 2011 8:42 pm
by turbo2ltr
sounds right.

Re: LEAF CANbus decoding. (Open discussion)

Posted: Mon May 30, 2011 9:32 pm
by GroundLoop
Find anything interesting there? Seemed the least useful of the three for snooping.